We've joined Protect AIJoin us over there for bounties up to $50,000+ for vulnerabilities in AI/ML repos

Reflected XSS in librenms/librenms

Valid

Reported on

Jan 30th 2023

Description

Reflected Cross-Site Scripting (XSS) vulnerability in LibreNMS 22.12.0 - Fri Dec 30 2022 10:11:51 GMT+0100 allows attackers to execute arbitrary external javascript code in the browser affected from /ports/group parameter.

  1. Login
  2. Navigate PoC link

Proof of Concept

http://YOURSITE/ports/group=OOOOO%3C%2Fscript%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E

Poc

POC

Impact

This vulnerability allows attackers to hijack the user's current session, steal relevant information, deface website or direct users to malicious websites and allows attacker to use for further exploitation.

We are processing your report and will contact the librenms team within 24 hours. 8 months ago
We have contacted a member of the librenms team and are waiting to hear back 8 months ago
Hakiduck
6 months ago

Researcher

@mantainer? any update on this?

Tony Murray validated this vulnerability 2 months ago
Hakiduck has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Tony Murray marked this as fixed in 23.8.0 with commit 91c57a 2 months ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
This vulnerability is scheduled to go public on Aug 15th 2023
Tony Murray published this vulnerability a month ago
to join this conversation