| Package | Affected versions | Patched versions |
|---|---|---|
| librenms/librenms | < 24.10.0 | 24.10.0 |
| librenms | < 24.10.0 | 24.10.0 |
A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of malicious code when a user accesses the page with a malicious "metric" parameter, potentially compromising their session and allowing unauthorized actions.
The "/wireless" and "/health" endpoints are vulnerable to reflected XSS in the "metric" parameter. An attacker can inject the following XSS payload into the "metric" parameter:
<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();<!---->
When the page is loaded with this malicious parameter, the script executes immediately. The vulnerability occurs due to improper sanitization of the "metric" parameter in the following sinks: https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/wireless.inc.php#L82 https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/health.inc.php#L114
<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();<!---->Example URL: http://<your_url>/wireless/metric=%3Cscript%3Econstructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();%3C!----%3E
Example Request:
GET /wireless/metric=%3Cscript%3Econstructor[%27constructor%27](atob(%27Y29uZmlybShkb2N1bWVudC5kb21haW4p%27))();%3C!----%3E HTTP/1.1
Host: <your_host>
Cookie: <your cookies>
This vulnerability allows attackers to execute arbitrary JavaScript in the context of a user’s session by crafting a malicious URL. The attack could lead to session hijacking, unauthorized actions, or further exploitation by injecting malicious scripts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free