Listen to this Post
How the mentioned CVE works:
The vulnerability is a stored Cross-Site Scripting (XSS) in the LibreNMS Alert Rule API. When an alert rule is created or updated via the API, the `add_edit_rule()` function in `includes/html/api_functions.inc.php` does not sanitize the rule name input, unlike the web interface. This allows an attacker to inject a malicious script, such as <script>alert(1)</script>, into the database. When an administrator later views the Alert Rules page, the backend code correctly sanitizes the name using the `e()` function, which encodes special characters into XML entities. However, the page uses the `bootgrid()` JavaScript library to enhance the table display. This client-side function rewrites the table cells and, as a side effect, decodes the previously safe XML entities back into active HTML tags. The browser then executes the injected script in the context of the victim’s session.
dailycve form:
Platform: LibreNMS
Version: < 25.12.0
Vulnerability : Stored XSS
Severity: Medium (4.3)
date: 2025-12-22
Prediction: 2026-04-15
What Undercode Say:
curl -X POST -H "X-Auth-Token: <token>" -H "Content-Type: application/json" https://<target>/api/v0/rules -d '{"name":"<script>alert(1)</script>"}'
grep -r "add_edit_rule" includes/
python3 poc.py ip_addr -T <token>
Inspect HTTP POST/PUT requests to `/api/v0/rules` and check if the `name` JSON value contains <.
How Exploit:
- Attacker with API privileges crafts a request to create an alert rule with a malicious script as the name.
- The unsanitized payload is stored in the database.
- A victim administrator navigates to the Alert Rules page.
- The `bootgrid()` JavaScript decodes the sanitized output, causing script execution.
Protection from this CVE:
Upgrade to version 25.12.0.
Impact:
Stored XSS via API. Attacker must have high privileges (PR:H). Can lead to session hijacking, data theft, or administrative actions on the victim’s behalf.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
