Executive brief
LibreNMS is a network monitoring platform that can integrate with Oxidized, a configuration management tool. When an administrator points LibreNMS to an Oxidized API endpoint, it fetches and displays device configuration data (node name, IP, model, author, commit messages) without properly escaping HTML characters. An attacker who controls a malicious server can inject JavaScript code into these fields, which executes in the browsers of any user viewing the device's configuration page, potentially allowing account takeover or data theft.
Technical details
This is a stored XSS vulnerability (CWE-79) combined with server-side request forgery (CWE-918). LibreNMS fetches device metadata from a configurable external Oxidized API endpoint and directly concatenates JSON response fields (name, ip, model, author, commit message) into HTML output in includes/html/pages/device/showconfig.inc.php (lines 276–278, 349, 353) without calling htmlspecialchars() or similar encoding. An admin can redirect the oxidized.url configuration to an attacker-controlled server that returns malicious JSON with embedded JavaScript payloads. When any user accesses the showconfig tab for any device, the unescaped payload executes in their browser with their privileges. Exploitation requires admin credentials to reconfigure the Oxidized URL, but impact is site-wide once configured. The fix applies htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to all rendered fields. Version 26.7.0 and later include the patch.
Affected products
- LibreNMS LibreNMS < 26.7.0
Timeline
- 2026-08-04: disclosed: Advisory published to GitHub Advisory Database
- 2026-08-04: patched: LibreNMS 26.7.0 released with fix