CVE-2025-47931
📋 TL;DR
This stored XSS vulnerability in LibreNMS allows attackers to inject malicious scripts into the 'group name' parameter of the poller groups form. When other users view the affected page, the scripts execute in their browser context. All LibreNMS installations running version 25.4.0 or earlier are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, redirect users to malicious sites, or install malware via drive-by downloads.
Likely Case
Session hijacking leading to unauthorized access, data theft, or privilege escalation within the LibreNMS application.
If Mitigated
Script execution blocked by Content Security Policy or modern browser XSS protections, limiting impact to minor UI manipulation.
🎯 Exploit Status
Exploitation requires authenticated access to the poller groups interface. The vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v25.5.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update to LibreNMS v25.5.0 using git: 'git pull origin master'. 3. Run database updates: './daily.sh'. 4. Verify the fix by checking the version: './lnms --version'.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side input validation to sanitize group name parameters
Edit includes/html/pages/addhost.inc.php and add htmlspecialchars() or similar sanitization to group name inputs
Content Security Policy
allImplement strict CSP headers to block inline script execution
Add 'Content-Security-Policy: script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict access to poller groups interface to trusted administrators only
- Implement web application firewall rules to block XSS payloads in group name parameters
🔍 How to Verify
Check if Vulnerable:
Check if your LibreNMS version is 25.4.0 or earlier: './lnms --version'Check Version:
./lnms --versionVerify Fix Applied:
After updating, verify version is 25.5.0 or later and test group name input with XSS payloads like '<script>alert(1)</script>'📡 Detection & Monitoring
Log Indicators:
- Unusual group name entries containing script tags or JavaScript in poller logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests with script tags in POST parameters to /poller/groups endpoint
SIEM Query:
source="*apache*" OR source="*nginx*" AND ("poller/groups" AND ("<script" OR "javascript:" OR "onerror="))