LibreNMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in LibreNMS versions prior to 24.11.0. This issue allows remote attackers to inject malicious scripts into the 'Display Name' field of device settings. The injected script is executed when the data is viewed, potentially leading to unauthorized actions or exposure of sensitive information.

Impact

Exploitation of this vulnerability allows for the execution of injected scripts, which could be used to perform unauthorized actions or access sensitive data.

Reproduction

To reproduce this vulnerability, add a new device in LibreNMS and navigate to the 'Device Settings' section. In the 'Display Name' field, enter a script injection payload, such as an image tag with an 'onerror' event. After saving the changes, the injected script will execute when the device logs are viewed and hovered over a relevant tag.

Remediation

Users are advised to upgrade to LibreNMS version 24.12.0 or later.