GHSA-c66p-64fj-jmc2 LibreNMS Misc Section Stored Cross-site Scripting vulnerability

• Packagist librenms/librenms: >= 23.9.0, < 24.11.0 → fixed in 24.11.0

StoredXSS-LibreNMS-MiscSection Description: Stored XSS on the parameter: `ajax_form.php` -> param: state Request: ```http POST /ajax_form.php HTTP/1.1 Host: X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: type=override-config&device_id=1&attrib=override_icmp_disable&state="> ``` of Librenms version 24.10.1 (https://github.com/librenms/librenms) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. The vulnerability in the line: ```php $attrib_val = get_dev_attrib($device, $name); ``` within the `dynamic_override_config` function arises because the value of `$attrib_val is` retrieved from untrusted data without any sanitization or encoding (at Line 778). When `dynamic_override_config` is called, the unescaped `$attrib_val` is injected directly into the HTML (at misc.inc.php). Proof of Concept: 1. Add a new device through the LibreNMS interface. 2. Edit the newly created device and select the Misc section. 3. In any of the following fields: "Override default ssh port", "Override default telnet port", "Override default http port" or "Unix agent port", enter the payload: `">`. 4. Save the changes. 5. Observe that when the page loads, the XSS payload executes, triggering a popup that displays the current cookies. Impact: Execution of Malicious Code