Listen to this Post
The vulnerability arises from multiple legacy PHP template files within LibreNMS that directly embed SNMP-sourced and syslog-sourced data into HTML responses without proper escaping or sanitization. An attacker who compromises or controls a network device monitored by the LibreNMS instance can exploit this to inject arbitrary JavaScript. This injected script executes in the browser of any authenticated LibreNMS user who views the affected pages, leading to potential session hijacking, data theft, or further attacks.
The flaw is present in several locations across the codebase. For instance, in `includes/html/print-syslog.inc.php` on lines 11 and 13, the `program` field from syslog messages is output without using htmlspecialchars(), unlike the adjacent `msg` field which is properly escaped. A more critical instance is found in `includes/html/functions.inc.php` on line 607, where the `ifAlias` (port description) retrieved via SNMP polling is rendered unescaped when a port-related alert is triggered. Other unescaped fields in the same function include isisISAdjIPAddrAddress, service_desc, service_message, bgpPeerDescr, mempool_descr, and app_type. The health pages for memory pools, storage, and sensors also output SNMP-polled descriptions (mempool_descr, storage_descr, sensor_descr) directly into `
` tags without escaping. Additional vulnerable locations include the pseudowires page (includes/html/pages/pseudowires.inc.php:76) and the VRF page (includes/html/pages/routing/vrf.inc.php:165), both of which display the `ifAlias` unsafely.
The attack flow is straightforward. An attacker first gains control of a network device that LibreNMS monitors. They then configure the device’s SNMP interface description (ifAlias) or send specially crafted syslog messages with a malicious payload. LibreNMS polls the device via SNMP or receives the syslog message, storing the unsanitized payload in its database. When an authenticated user views an affected page—such as the alerts, health, or syslog viewer—the legacy PHP template retrieves and echoes the raw payload into the HTML, causing the JavaScript to execute in the user’s browser.
DailyCVE Form:
Platform: LibreNMS
Version: < 26.5.0
Vulnerability: Stored XSS
Severity: High (CVSS 7.1)
date: 2026-08-26
Prediction: 2026-09-15
What Undercode Say:
The vulnerability is a classic case of improper output encoding in legacy code. While newer Blade templates and some updated PHP files correctly escape data using functions like Clean::html(), htmlentities(), and htmlspecialchars(), or rely on Blade’s `{{ }}` auto-escaping, the legacy `includes/html/` files have not been migrated. This inconsistency creates a significant security gap. To identify potentially vulnerable instances, administrators can audit their codebase for files in `includes/html/` that output SNMP or syslog data without sanitization. A command to search for such patterns is:
grep -r "includes/html/" --include=".php" -e "echo" -e "print" | grep -v "htmlspecialchars" | grep -v "Clean::html"
Exploit: (Educational Purposes!)
An attacker can demonstrate this vulnerability through two primary vectors:
1. Syslog Vector: An attacker sends a malicious syslog message to the LibreNMS syslog receiver (e.g., at 10.0.0.1:514). The `program` field contains the XSS payload.
echo '<14>Mar 20 12:00:00 rogue-device <img/src=x onerror=alert(document.domain)>: test message' | nc -u 10.0.0.1 514
2. SNMP Vector: An attacker with control over a monitored device sets its SNMP interface description (ifAlias) to a malicious payload.
snmpset -v2c -c private localhost IF-MIB::ifAlias.1 s '<img src=x onerror=alert(document.cookie)>'
Once LibreNMS polls the device during its next discovery or polling cycle, the payload is stored and will execute when any authenticated user views an affected page like the alerts dashboard.
Protection:
The primary mitigation is to upgrade LibreNMS to version 26.5.0 or later, where this vulnerability is patched. If an immediate upgrade is not possible, administrators should consider restricting which devices can send syslog messages to the LibreNMS server and ensure that SNMP community strings are strong and not easily guessable. Additionally, implementing a Web Application Firewall (WAF) with rules to detect and block common XSS payloads in SNMP and syslog data can provide a temporary layer of defense.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated user’s session. This can lead to:
– Session Hijacking: Stealing session cookies to impersonate the victim user.
– Data Theft: Accessing sensitive information visible on the page or making API requests on behalf of the user.
– Defacement: Modifying the content of the page displayed to the user.
– Further Attacks: Using the compromised session as a pivot point to launch attacks against internal network resources.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
