{"id":"GHSA-7gww-x7fh-jf9j","title":"LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page","summary":"LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page","severity":"high","cvss":8.1,"cwe":["CWE-79","CWE-918"],"vendor":"librenms","product":"librenms/librenms","ecosystem":"composer","affected":["librenms/librenms < 26.7.0"],"patched":["librenms/librenms 26.7.0"],"published":"2026-08-18","updated":"2026-08-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7gww-x7fh-jf9j","references":[{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-7gww-x7fh-jf9j"},{"url":"https://github.com/librenms/librenms/releases/tag/26.7.0"},{"url":"https://github.com/advisories/GHSA-7gww-x7fh-jf9j"}],"tags":["ghsa","composer"],"ingestedAt":"2026-08-18T21:22:59.473Z","slug":"GHSA-7gww-x7fh-jf9j","body":"## Overview\n\n### Summary\nThe Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (`name`, `ip`, `model`, `author`, commit message) into HTML without `htmlspecialchars()`. An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab.\n\n### CVSS\n`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N` — **8.1 High**\n\n### Details\n```php\n// includes/html/pages/device/showconfig.inc.php:276-278\necho '<li ...><strong>Node:</strong> ' . $node_info['name'] . '</li>';\necho '<li ...><strong>IP:</strong> '   . $node_info['ip']   . '</li>';\necho '<li ...><strong>Model:</strong> '. $node_info['model'] . '</li>';\n// lines 349, 353: author and commit message also unescaped\n```\n\n### Attack chain\n1. Admin sets `oxidized.url` to `http://attacker.example.com/`.\n2. Attacker server returns `{\"name\":\"<img src=x onerror=alert(1)>\",\"ip\":\"x\",\"model\":\"x\"}`.\n3. Any user viewing any device showconfig tab triggers the XSS.\n\n### PoC\nMock Oxidized server confirmed in response:\n```\n[!!!] CONFIRMED — ...<strong>Node:</strong> <img src=x onerror=\"alert('SSRF-XSS-oxidized')\">...\n```\n\n### Fix\n```php\necho '<li ...><strong>Node:</strong> ' . htmlspecialchars($node_info['name'], ENT_QUOTES, 'UTF-8') . '</li>';\n```\nApply to all fields from `$node_info`, `$author`, `$msg`.\n\n### Prerequisite\nAdmin session. Oxidized integration must be enabled.\n\n## Affected packages\n\n- `librenms/librenms < 26.7.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `librenms/librenms 26.7.0`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}