Stored XSS via SNMP and Syslog in LibreNMS

LibreNMS versions prior to 26.5.0 contain multiple stored cross-site scripting (XSS) vulnerabilities within legacy PHP templates located in the includes/html/ directory. The vulnerability stems from the direct echoing of data retrieved from SNMP-monitored network devices and incoming syslog messages without appropriate output encoding or escaping.

Specific components impacted include the syslog viewer, alert details page, and device health monitoring dashboards (mempool, storage, and sensors). An attacker with the ability to modify SNMP interface descriptions (ifAlias) or send arbitrary syslog traffic to the LibreNMS server can inject malicious JavaScript. When an authenticated LibreNMS administrator or user views these dashboards, the payload executes within their browser context. This allows attackers to perform actions on behalf of the user, potentially including credential theft or unauthorized configuration changes within the monitoring platform. The issue is exacerbated by the platform's reliance on legacy PHP templates that bypass the auto-escaping features present in newer Blade-based templates.

Attack Chain

1. Attacker establishes control over a network device or syslog-capable host monitored by the target LibreNMS instance.
2. Attacker modifies the SNMP ifAlias (interface description) or sends a crafted syslog program string containing a JavaScript payload (e.g., <img src=x onerror="fetch('...')">).
3. LibreNMS performs its scheduled SNMP discovery/polling cycle or receives the syslog packet.
4. The unescaped, malicious string is stored directly into the LibreNMS SQL database (e.g., the ports table or syslog table).
5. An authenticated LibreNMS user navigates to the affected web interface (e.g., Alerts page, Health dashboard, or Syslog view).
6. The legacy PHP template fetches the malicious string from the database and echoes it raw into the HTML response.
7. The victim's web browser renders the HTML and executes the attacker's JavaScript payload within the context of the user session.
8. Attacker achieves unauthorized execution, such as data exfiltration or session manipulation.

Impact

The vulnerability allows an attacker to compromise the sessions of authenticated users, which can lead to unauthorized access to the network monitoring platform. Given that LibreNMS often holds high-privileged credentials and visibility into sensitive infrastructure, successful exploitation could facilitate lateral movement, information gathering, or operational disruption. The impact is significant for organizations using LibreNMS as a central visibility tool for core network components.

Recommendation

• Upgrade all LibreNMS installations to version 26.5.0 or later immediately.
• Audit logs for unexpected characters or script tags in SNMP interface descriptions or syslog program fields.
• Restrict access to SNMP configuration and syslog submission channels to trusted IP ranges to prevent unauthorized data injection.
• Use the webserver log source to monitor for unusual POST/GET patterns directed at health, alert, and syslog endpoints.