CVE-2025-23200: Stored XSS-LibreNMS-Misc Section in librenms

StoredXSS-LibreNMS-MiscSection

Description:

Stored XSS on the parameter: ajaxform.php -> param: state

Request: http POST /ajaxform.php HTTP/1.1 Host: <yourhost> X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: <yourXSRFtoken> Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: <yourcookie>

type=override-config&deviceid=1&attrib=overrideicmpdisable&state="><img%20src%20onerror="alert(1)">

of Librenms version 24.10.1 (https://github.com/librenms/librenms) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.

The vulnerability in the line: php $attribval = getdevattrib($device, $name); within the dynamicoverrideconfig function arises because the value of $attribval is retrieved from untrusted data without any sanitization or encoding (at Line 778).

When dynamicoverrideconfig is called, the unescaped $attribval is injected directly into the HTML (at misc.inc.php).

Proof of Concept: 1. Add a new device through the LibreNMS interface. 2. Edit the newly created device and select the Misc section. 3. In any of the following fields: "Override default ssh port", "Override default telnet port", "Override default http port" or "Unix agent port", enter the payload: "><img src onerror="alert(document.cookie)">. 4. Save the changes. 5. Observe that when the page loads, the XSS payload executes, triggering a popup that displays the current cookies.

!image !image

Impact:

Execution of Malicious Code