Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-62412

CVE-2025-62412: LibreNMS alert-rules has a Cross-Site Scripting Vulnerability

3.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-62412
GHSA ID
GHSA-6g2v-66ch-6xmh
EPSS Score
-
CWE
CWE-79
Published
10/16/2025
Updated
10/16/2025
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
librenms/librenmscomposer<= 25.8.025.10.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) in the LibreNMS alert rules functionality. The root cause is twofold: insufficient input sanitization and a lack of output escaping.

  1. Input Processing: As detailed in the vulnerability description, when an alert rule is created via ajax_form.php, the name parameter is processed by includes/html/forms/alert-rules.inc.php. This script attempts to sanitize the input using strip_tags(), but this function can be bypassed using techniques like XML character references, allowing a malicious payload to be stored in the database.

  2. Output Rendering: The provided patch (dccdf6769976a974d70f06a7ce8d5a846b29db6f) clearly shows where the vulnerability is triggered. The file includes/html/modal/alert_rule_list.inc.php is responsible for displaying the list of alert rules. Before the patch, it directly rendered the rule name ({$rule['name']}) into the HTML. This allows the stored malicious payload to be executed in the victim's browser.

The identified vulnerable function is the script alert_rule_list.inc.php itself, as the vulnerable code is within its global scope and is executed when the file is included to generate the alert list. A runtime profiler would show this script in the execution path when the vulnerability is triggered by a user viewing the alert rules page.

Vulnerable functions

alert_rule_list.inc.php
includes/html/modal/alert_rule_list.inc.php
This PHP script is responsible for rendering the list of alert rules within a modal dialog. The vulnerability lies in the line where the alert rule's name, `{$rule['name']}`, is directly echoed into an HTML table cell without proper output escaping. An attacker can create an alert rule with a malicious name containing a script payload. When a user views the list of alert rules, this script is executed in their browser. The patch fixes this by wrapping the output with the `e()` function, which is a common helper for `htmlspecialchars` to prevent XSS.

WAF Protection Rules

WAF Rule

## *x**utiv* Summ*ry **Pro*u*t:** Li*r*NMS **V*n*or:** Li*r*NMS **Vuln*r**ility Typ*:** *ross-Sit* S*riptin* (XSS) ***VSS S*or*:** *.* (*V:N/**:L/PR:*/UI:R/S:U/*:L/I:L/*:L) *******t** V*rsion:** **.*.* (l*t*st *t tim* o* *is*ov*ry) **PO* *

Reasoning

T** vuln*r**ility is * stor** *ross-Sit* S*riptin* (XSS) in t** Li*r*NMS *l*rt rul*s *un*tion*lity. T** root **us* is two*ol*: insu**i*i*nt input s*nitiz*tion *n* * l**k o* output *s**pin*. *. **Input Pro**ssin***: *s **t*il** in t** vuln*r**ility