-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 25.11.0 | 25.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue in the /maps/nodeimage endpoint of LibreNMS. The Image Name parameter was not properly sanitized before being reflected in the server's response.
The analysis of the security patch, commit 3daddcf66cdbb93ea8aa40ac439cbca5beae5280, reveals the exact location of the vulnerability. The patch modifies the app/Http/Controllers/Maps/CustomMapNodeImageController.php file.
Specifically, two methods in the CustomMapNodeImageController class were fixed:
store(): This method handles the creation of new node images. The original code returned the raw image name ($image->name) in the JSON response. The patch applies htmlentities() to this value.update(): This method handles updates to existing node images. The original code returned the raw request input for the name ($request['name']) in the JSON response. The patch applies htmlentities() to the name from the model ($image->name) before sending it in the response.These changes confirm that both the creation and update operations were vulnerable. An attacker could inject a malicious script into the Image Name field, which would then be executed in the browser of a user viewing the response. Therefore, the store and update functions are the vulnerable functions that would appear in a runtime profile during exploitation. The profiler would show them as LibreNMS\Http\Controllers\Maps\CustomMapNodeImageController::store and LibreNMS\Http\Controllers\Maps\CustomMapNodeImageController::update.
LibreNMS\Http\Controllers\Maps\CustomMapNodeImageController::storeapp/Http/Controllers/Maps/CustomMapNodeImageController.php
LibreNMS\Http\Controllers\Maps\CustomMapNodeImageController::updateapp/Http/Controllers/Maps/CustomMapNodeImageController.php
PHPPHPImage NamePoC-XXS51 will appear.The supplied payload is reflected in the HTTP response and interpreted by the browser, resulting in immediate execution (demonstrated by an alert popup). This confirms the application does not perform appropriate output encoding for the Image Name parameter.
Reflected XSS can be used to:
Execute arbitrary JavaScript in the context of any user who visits the crafted link.
Steal session cookies or authentication tokens (leading to session hijacking).
Perform actions on behalf of the victim (CSRF-like actions executed via script).
Phish users by manipulating the page UI, or exfiltrate sensitive information visible to the victim.
Pivot to further attacks depending on application context and user privileges.
CWE-79 — Cross-Site Scripting (XSS).
OWASP XSS Prevention Cheat Sheet.
Ongoing coverage of React2Shell