Skip to content

Stored XSS in poller group name

Moderate
murrant published GHSA-hxw5-9cc5-cmw5 May 17, 2025

Package

composer https://github.com/librenms/librenms (Composer)

Affected versions

25.4.0

Patched versions

25.5.0

Description

LibreNMS v25.4.0 suffers from Stored Cross-Site Scripting (XSS) Vulnerability in the 'group name' parameter of the 'http://localhost/poller/groups' form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users.

---------------------------------POC-----------------------------

Before Setting: Enable 'distributed_poller' in http://localhost/settings/poller/distributed

  1. Attacker creates a new poller group and injects the payload in the 'group name' parameter
payload: <script>alert('XSS')</script>
  1. Victim navigates to the 'http://localhost/addhost' to add a new host
  2. The payload is executed

code sink:
https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284

Severity

Moderate

CVE ID

CVE-2025-47931

Weaknesses

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Learn more on MITRE.

Credits