{"id":"GHSA-7gww-x7fh-jf9j","aliases":[],"url":"https://o3.security/vulnerability/GHSA-7gww-x7fh-jf9j","summary":"LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page","details":"### Summary\nThe Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (`name`, `ip`, `model`, `author`, commit message) into HTML without `htmlspecialchars()`. An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab.\n\n### CVSS\n`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N` — **8.1 High**\n\n### Details\n```php\n// includes/html/pages/device/showconfig.inc.php:276-278\necho '<li ...><strong>Node:</strong> ' . $node_info['name'] . '</li>';\necho '<li ...><strong>IP:</strong> '   . $node_info['ip']   . '</li>';\necho '<li ...><strong>Model:</strong> '. $node_info['model'] . '</li>';\n// lines 349, 353: author and commit message also unescaped\n```\n\n### Attack chain\n1. Admin sets `oxidized.url` to `http://attacker.example.com/`.\n2. Attacker server returns `{\"name\":\"<img src=x onerror=alert(1)>\",\"ip\":\"x\",\"model\":\"x\"}`.\n3. Any user viewing any device showconfig tab triggers the XSS.\n\n### PoC\nMock Oxidized server confirmed in response:\n```\n[!!!] CONFIRMED — ...<strong>Node:</strong> <img src=x onerror=\"alert('SSRF-XSS-oxidized')\">...\n```\n\n### Fix\n```php\necho '<li ...><strong>Node:</strong> ' . htmlspecialchars($node_info['name'], ENT_QUOTES, 'UTF-8') . '</li>';\n```\nApply to all fields from `$node_info`, `$author`, `$msg`.\n\n### Prerequisite\nAdmin session. Oxidized integration must be enabled.","published":"2026-08-18T21:17:23Z","modified":"2026-08-18T21:30:07.928083206Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"librenms/librenms","fixedVersion":"26.7.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/librenms/librenms/security/advisories/GHSA-7gww-x7fh-jf9j"},{"type":"PACKAGE","url":"https://github.com/librenms/librenms"},{"type":"WEB","url":"https://github.com/librenms/librenms/releases/tag/26.7.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T21:30:07.928083206Z"}}