Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in LibreNMS, a network monitoring system, that could allow an attacker to inject malicious code through a misconfigured integration. If exploited, this could lead to the display of harmful content to users viewing device configurations, potentially impacting trust and operational awareness. The primary concern is to confirm if this specific integration is in use and if an administrator could be tricked into pointing it to a malicious source.
- Malicious code can be hidden in configuration data.
- Affects all users viewing device configurations.
- Confirm if your LibreNMS uses this specific integration.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by configuring the LibreNMS Oxidized integration URL to point to a malicious server. When an administrator views the configuration page for any device, the system retrieves and displays JSON data from the attacker's server without proper sanitization. This allows the attacker to inject malicious HTML and JavaScript, leading to stored cross-site scripting that impacts all users viewing the device configuration page.
- Requires administrator-level access to configure.
- Triggered by viewing device configuration.
- Stored XSS affects all users.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an administrator pointing the Oxidized integration URL at an attacker-controlled server could lead to persistent cross-site scripting. This would affect users viewing any device's configuration page by rendering malicious JSON data from the attacker.
- Stored XSS on device configuration pages.
- Attacker-controlled JSON from Oxidized URL.
- Affects users viewing device configs.
Operational Fix
Recommended remediation, mitigation, and detection steps
Compromised LibreNMS instances present a risk to all users who view the device configuration page if an administrator has configured an attacker-controlled Oxidized integration URL. The platform team or application owner is responsible for addressing this vulnerability, prioritizing identification and assessment of affected instances. First, confirm where LibreNMS is deployed, verify if the Oxidized integration is configured with a trusted URL, and determine if any instances are business-critical.
- Platform or application owners.
- Verify Oxidized integration configuration.
- Plan remediation or mitigation.
