GHSA-7gww-x7fh-jf9j

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Published

2026-08-18

Modified

2026-08-18

Sources

github-advisory

Summary

### Summary The Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (`name`, `ip`, `model`, `author`, commit message) into HTML without `htmlspecialchars()`. An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab. ### CVSS `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N` — **8.1 High** ### Details ```php // includes/html/pages/device/showconfig.inc.php:276-278 echo ' Node: ' . $node_info['name'] . ' '; echo ' IP: ' . $node_info['ip'] . ' '; echo ' Model: '. $node_info['model'] . ' '; // lines 349, 353: author and commit message also unescaped ``` ### Attack chain 1. Admin sets `oxidized.url` to `http://attacker.example.com/`. 2. Attacker server returns `{"name":" ","ip":"x","model":"x"}`. 3. Any user viewing any device showconfig tab triggers the XSS. ### PoC Mock Oxidized server confirmed in response: ``` [!!!] CONFIRMED — ... Node: ... ``` ### Fix ```php echo ' Node: ' . htmlspecialchars($node_info['name'], ENT_QUOTES, 'UTF-8') . ' '; ``` Apply to all fields from `$node_info`, `$author`, `$msg`. ### Prerequisite Admin session. Oxidized integration must be enabled.

Affected packages

Remediation: Upgrade to 26.7.0 or later.

References

• https://github.com/advisories/GHSA-7gww-x7fh-jf9j