Security Advisories: GSA_kwCzR0hTQS1jNjZwLTY0Zmotam1jMs4ABDb6

LibreNMS Misc Section Stored Cross-site Scripting vulnerability

StoredXSS-LibreNMS-MiscSection

Description:

Stored XSS on the parameter: ajax_form.php -> param: state

Request:

POST /ajax_form.php HTTP/1.1
Host: <your_host>
X-Requested-With: XMLHttpRequest
X-CSRF-TOKEN: <your_XSRF_token>
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: <your_cookie>

type=override-config&device_id=1&attrib=override_icmp_disable&state="><img%20src%20onerror="alert(1)"> 

of Librenms version 24.10.1 (https://github.com/librenms/librenms) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.

The vulnerability in the line:

$attrib_val = get_dev_attrib($device, $name);

within the dynamic_override_config function arises because the value of $attrib_val is retrieved from untrusted data without any sanitization or encoding (at Line 778).

When dynamic_override_config is called, the unescaped $attrib_val is injected directly into the HTML (at misc.inc.php).

Proof of Concept:

1. Add a new device through the LibreNMS interface.
2. Edit the newly created device and select the Misc section.
3. In any of the following fields: "Override default ssh port", "Override default telnet port", "Override default http port" or "Unix agent port", enter the payload: "><img src onerror="alert(document.cookie)">.
4. Save the changes.
5. Observe that when the page loads, the XSS payload executes, triggering a popup that displays the current cookies.

Impact:

Execution of Malicious Code

Permalink: https://github.com/advisories/GHSA-c66p-64fj-jmc2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNjZwLTY0Zmotam1jMs4ABDb6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 1 day ago
Updated: about 1 hour ago

CVSS Score: 4.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.1136

Identifiers: GHSA-c66p-64fj-jmc2, CVE-2025-23200
References:

• https://github.com/librenms/librenms/security/advisories/GHSA-c66p-64fj-jmc2
• https://github.com/librenms/librenms/pull/16722
• https://github.com/librenms/librenms/commit/26258a2518dbfa55b213ec4b90ec16ed97efb597
• https://nvd.nist.gov/vuln/detail/CVE-2025-23200
• https://github.com/advisories/GHSA-c66p-64fj-jmc2

Repository: https://github.com/librenms/librenms
Blast Radius: 1.4

Affected Packages