Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the device group management page of LibreNMS. The root cause is the improper handling of the device group name when constructing the delete confirmation dialog.
An attacker with administrative privileges can create a device group with a name containing a malicious JavaScript payload. When the device groups page is rendered, this name is inserted directly into an onclick attribute for a button, within a call to the delete_dg JavaScript function. The patch 64b31da444369213eb4559ec1c304ebfaa0ba12c addresses this by moving the device group name from the onclick attribute to a data-group-name attribute. The delete_dg function is then modified to safely retrieve the name from this data attribute using button.dataset.groupName. This prevents the browser from interpreting the malicious name as executable code.
The vulnerable function is the inline JavaScript function delete_dg as it is the sink for the unsanitized input $device_group->name which is rendered in the resources/views/device-group/index.blade.php file.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 26.2.0 | 26.2.0 |
