LibreNMS: reflected XSS in the Proxmox view runs script in a logged-in monitoring user's session

Impact

The instance and vmid GET parameters of the Proxmox view are placed into the page title with only strip_tags applied, and the title is then interpolated into an inline document.title assignment, so a single quote closes the JavaScript string and the rest of the input executes. An operator who follows a crafted link while logged in runs the attacker's script with their LibreNMS session, which allows session data theft and any action the UI offers that account. LibreNMS holds SNMP and device credentials for the fabric it polls, so a hijacked NOC session is a foothold into network management rather than just a defaced page. This needs the victim to click, and it is a browser-session compromise - it does not by itself give code execution on the LibreNMS host.

Who can reach it

An attacker who can get an already-authenticated LibreNMS user to open a crafted URL. The attacker needs a low-privileged authenticated position per the vendor scoring, and the victim must interact.

What to do

Upgrade LibreNMS to 26.5.0, or apply commit 0be1bfd7746cea26bf7da40e82b70f75b724d0f8 if you track git. This is a code update to the web application - no node drain or reboot, though php-fpm or the web worker should be reloaded after the update.

References

Related entries

• CloudNativePG instance manager (status server, TCP/8000 control endpoints): A set of operator-only control endpointsNCVD-2026-050-cloudnativepg-instance-manager-s · CloudNativePG instance manager (status server, TCP/8000 control endpoints)Medium
• Slurm (user_name / gid field handling): Slurm trusts the user_name and gid fields carried in job RPCs instead ofCVE-2018-10995 · Slurm (user_name / gid field handling)Medium
• IBM Spectrum LSF (job submission, file permissions): Weak file permissions in the LSF install let a local user changeCVE-2018-1724 · IBM Spectrum LSF (job submission, file permissions)Medium
• AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016): Insufficient RMP checking on IOMMU host bufferCVE-2023-20585 · AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016)Medium
• ZKTeco BioAccess IVS v3.3.1 access control platform: An unauthenticated attacker can open and close any doorCVE-2023-38958 · ZKTeco BioAccess IVS v3.3.1 access control platformMedium
• Intel Data Center GPU Flex Series - Windows driver software: Improper access control in the Flex Series Windows driverCVE-2024-43101 · Intel Data Center GPU Flex Series - Windows driver softwareMedium