GHSA-7gww-x7fh-jf9j: XSS
Summary The Oxidized integration URL (oxidized.url) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (name, ip, model, author, commit message) into HTML without htmlspecialchars(). An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab.
CVSS CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N — 8.1 High
Details php // includes/html/pages/device/showconfig.inc.php:276-278 echo '<li ...><strong>Node:</strong> ' . $nodeinfo['name'] . '</li>'; echo '<li ...><strong>IP:</strong> ' . $nodeinfo['ip'] . '</li>'; echo '<li ...><strong>Model:</strong> '. $nodeinfo['model'] . '</li>'; // lines 349, 353: author and commit message also unescaped
Attack chain 1. Admin sets oxidized.url to http://attacker.example.com/. 2. Attacker server returns {"name":"<img src=x onerror=alert(1)>","ip":"x","model":"x"}. 3. Any user viewing any device showconfig tab triggers the XSS.
PoC Mock Oxidized server confirmed in response: [!!!] CONFIRMED — ...<strong>Node:</strong> <img src=x onerror="alert('SSRF-XSS-oxidized')">...
Fix php echo '<li ...><strong>Node:</strong> ' . htmlspecialchars($nodeinfo['name'], ENTQUOTES, 'UTF-8') . '</li>'; Apply to all fields from $nodeinfo, $author, $msg.
Prerequisite Admin session. Oxidized integration must be enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/librenms/librenmsto a version that resolves this vulnerability.Fixed in 26.7.0 - Configuration
In LibreNMS, update the Oxidized integration URL setting `oxidized.url` so it points only to a trusted Oxidized server. Do not set `oxidized.url` to an attacker-controlled server, since JSON fields returned by that server (e.g., `$node_info`, `$author`, and commit message) are rendered into HTML without `htmlspecialchars()`.
LibreNMS Oxidized integration oxidized.url = (set to a trusted URL; do not point to attacker-controlled servers)
Event History
Frequently Asked Questions
Which users and deployments are realistically exposed?
LibreNMS installations that use the admin-configurable oxidized.url integration are exposed if an administrator points it to an attacker-controlled server. The resulting stored script executes for any user who opens any device’s showconfig tab.
What conditions are required to exploit this issue?
An attacker needs an administrator to configure oxidized.url to an attacker-controlled endpoint, and that endpoint must return crafted JSON in fields such as name, ip, model, author, or commit message. A user must then view a device’s showconfig tab for the script to execute.
Is a default configuration known to be affected?
The described attack depends on an administrator changing oxidized.url to an attacker-controlled URL. The provided information does not indicate that a default URL or default configuration is affected.
What can be done to reduce risk before patching?
If patching cannot happen immediately, prevent oxidized.url from referencing untrusted or attacker-controlled servers and restrict who can modify that setting. Review the configured endpoint and its returned JSON content, especially the rendered fields identified in the advisory.
How can administrators check for possible exposure?
Check the configured oxidized.url and determine whether it points to an untrusted endpoint. Review device showconfig output and the integration responses for HTML or script-like content in name, ip, model, author, and commit-message fields.