GHSA-7gww-x7fh-jf9j LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

• Packagist librenms/librenms: < 26.7.0 → fixed in 26.7.0

Summary The Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (`name`, `ip`, `model`, `author`, commit message) into HTML without `htmlspecialchars()`. An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab. CVSS `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N` — 8.1 High Details ```php // includes/html/pages/device/showconfig.inc.php:276-278 echo 'Node: ' . $node_info['name'] . ''; echo 'IP: ' . $node_info['ip'] . ''; echo 'Model: '. $node_info['model'] . ''; // lines 349, 353: author and commit message also unescaped ``` Attack chain 1. Admin sets `oxidized.url` to `http://attacker.example.com/`. 2. Attacker server returns `{"name":"","ip":"x","model":"x"}`. 3. Any user viewing any device showconfig tab triggers the XSS. PoC Mock Oxidized server confirmed in response: ``` [!!!] CONFIRMED — ...Node: ... ``` Fix ```php echo 'Node: ' . htmlspecialchars($node_info['name'], ENT_QUOTES, 'UTF-8') . ''; ``` Apply to all fields from `$node_info`, `$author`, `$msg`. Prerequisite Admin session. Oxidized integration must be enabled.