Description

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-01T12:17:48.287Z",
  "pubdate": "2026-09-01T12:17:48.287Z",
  "executiveSummary": "LibreNMS versions through 26.4.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability facilitated by the Oxidized integration feature.\nThe vulnerability arises due to the application failing to sanitize specific JSON fields returned from an external Oxidized server before rendering them on the device showconfig page.\nAn authenticated administrator can exploit this by configuring the 'oxidized.url' parameter to point to a malicious server under their control.\nThis server can then serve crafted JSON payloads containing malicious scripts, which are subsequently stored and executed in the browser context of any user viewing the device's showconfig tab.\nThe risk is categorized as high, as it allows for arbitrary JavaScript execution, potentially leading to session hijacking, unauthorized actions, or further lateral movement within the LibreNMS environment.\nExploitation requires administrative privileges to modify the integration URL, followed by interaction with an attacker-controlled endpoint.\nThe issue is remediated in version 26.7.0 by the implementation of proper output encoding using htmlspecialchars() or equivalent security controls.",
  "technicalDetails": "The vulnerability is a classic case of improper output neutralization leading to Stored Cross-Site Scripting (XSS). The LibreNMS application includes an integration feature with Oxidized, a network configuration backup tool. Users with administrative access can configure the application to fetch configuration metadata from a remote Oxidized instance via the 'oxidized.url' setting.\nThe root cause of this vulnerability is the lack of server-side or client-side output encoding when the application renders JSON data retrieved from the configured Oxidized URL. Specifically, the fields 'name', 'ip', 'model', 'author', and 'commit message' returned in the JSON response are rendered directly into the HTML structure of the 'showconfig' page without passing through the htmlspecialchars() function or an equivalent sanitization routine.\nThe attack flow proceeds as follows: First, an attacker with administrative privileges modifies the 'oxidized.url' configuration within LibreNMS to point to a malicious web server hosted by the attacker. This constitutes an SSRF-like vector, as the LibreNMS server will initiate an outbound connection to the attacker's controlled resource.\nSecond, the attacker's malicious server waits for the LibreNMS application to poll it for device configuration metadata. Upon receiving a request, the malicious server responds with a crafted JSON object where one of the vulnerable fields (e.g., 'author' or 'commit message') contains an XSS payload, such as '<script>alert(document.cookie)</script>' or more complex obfuscated JavaScript.\nThird, the LibreNMS application parses the JSON response and stores the malicious metadata within its internal data structures or caches. Finally, when any user—including other administrators or privileged operators—navigates to the device's showconfig tab, the application retrieves the stored malicious string and injects it directly into the HTML document's DOM.\nBecause the payload is rendered without escaping, the browser interprets the script tags as executable code rather than plain text. This results in the execution of the payload within the context of the user's active session. The impact is significant, as it enables the execution of arbitrary JavaScript, which can be utilized to steal session cookies, perform unauthorized API requests on behalf of the victim, or redirect users to malicious sites, thereby compromising the integrity and confidentiality of the LibreNMS instance."
}