GHSA-7GWW-X7FH-JF9J

Vulnerability from github – Published: 2026-08-18 21:17 – Updated: 2026-08-18 21:17
VLAI
Summary
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Details

Summary

The Oxidized integration URL (oxidized.url) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (name, ip, model, author, commit message) into HTML without htmlspecialchars(). An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab.

CVSS

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N — 8.1 High

Details

// includes/html/pages/device/showconfig.inc.php:276-278
echo '<li ...><strong>Node:</strong> ' . $node_info['name'] . '</li>';
echo '<li ...><strong>IP:</strong> '   . $node_info['ip']   . '</li>';
echo '<li ...><strong>Model:</strong> '. $node_info['model'] . '</li>';
// lines 349, 353: author and commit message also unescaped

Attack chain

  1. Admin sets oxidized.url to http://attacker.example.com/.
  2. Attacker server returns {"name":"<img src=x onerror=alert(1)>","ip":"x","model":"x"}.
  3. Any user viewing any device showconfig tab triggers the XSS.

PoC

Mock Oxidized server confirmed in response:

[!!!] CONFIRMED — ...<strong>Node:</strong> <img src=x onerror="alert('SSRF-XSS-oxidized')">...

Fix

echo '<li ...><strong>Node:</strong> ' . htmlspecialchars($node_info['name'], ENT_QUOTES, 'UTF-8') . '</li>';

Apply to all fields from $node_info, $author, $msg.

Prerequisite

Admin session. Oxidized integration must be enabled.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "librenms/librenms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T21:17:23Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (`name`, `ip`, `model`, `author`, commit message) into HTML without `htmlspecialchars()`. An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device\u0027s showconfig tab.\n\n### CVSS\n`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N` \u2014 **8.1 High**\n\n### Details\n```php\n// includes/html/pages/device/showconfig.inc.php:276-278\necho \u0027\u003cli ...\u003e\u003cstrong\u003eNode:\u003c/strong\u003e \u0027 . $node_info[\u0027name\u0027] . \u0027\u003c/li\u003e\u0027;\necho \u0027\u003cli ...\u003e\u003cstrong\u003eIP:\u003c/strong\u003e \u0027   . $node_info[\u0027ip\u0027]   . \u0027\u003c/li\u003e\u0027;\necho \u0027\u003cli ...\u003e\u003cstrong\u003eModel:\u003c/strong\u003e \u0027. $node_info[\u0027model\u0027] . \u0027\u003c/li\u003e\u0027;\n// lines 349, 353: author and commit message also unescaped\n```\n\n### Attack chain\n1. Admin sets `oxidized.url` to `http://attacker.example.com/`.\n2. Attacker server returns `{\"name\":\"\u003cimg src=x onerror=alert(1)\u003e\",\"ip\":\"x\",\"model\":\"x\"}`.\n3. Any user viewing any device showconfig tab triggers the XSS.\n\n### PoC\nMock Oxidized server confirmed in response:\n```\n[!!!] CONFIRMED \u2014 ...\u003cstrong\u003eNode:\u003c/strong\u003e \u003cimg src=x onerror=\"alert(\u0027SSRF-XSS-oxidized\u0027)\"\u003e...\n```\n\n### Fix\n```php\necho \u0027\u003cli ...\u003e\u003cstrong\u003eNode:\u003c/strong\u003e \u0027 . htmlspecialchars($node_info[\u0027name\u0027], ENT_QUOTES, \u0027UTF-8\u0027) . \u0027\u003c/li\u003e\u0027;\n```\nApply to all fields from `$node_info`, `$author`, `$msg`.\n\n### Prerequisite\nAdmin session. Oxidized integration must be enabled.",
  "id": "GHSA-7gww-x7fh-jf9j",
  "modified": "2026-08-18T21:17:23Z",
  "published": "2026-08-18T21:17:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/security/advisories/GHSA-7gww-x7fh-jf9j"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/librenms/librenms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/releases/tag/26.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.