GHSA-fqx6-693c-f55g LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()

• Packagist librenms/librenms: >= 24.10.0, < 26.2.0 → fixed in 26.2.0

Summary The `unit` parameter in Custom OID functionality lacks `strip_tags()` sanitization while other fields (`name`, `oid`, `datatype`) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping, allowing Stored XSS. Details Vulnerable Input Processing (`includes/html/forms/customoid.inc.php` lines 18-21): ```php $name = strip_tags((string) $_POST['name']); // line 18 - SANITIZED $oid = strip_tags((string) $_POST['oid']); // line 19 - SANITIZED $datatype = strip_tags((string) $_POST['datatype']); // line 20 - SANITIZED $unit = $_POST['unit']; // line 21 - NOT SANITIZED! ``` Vulnerable Output (`graphs/customoid.inc.php` lines 13-20): ```php $customoid_unit = $customoid['customoid_unit']; // Retrieved from DB $customoid_current = \LibreNMS\Util\Number::formatSi(...) . $customoid_unit; echo "...$customoid_current..."; // ECHOED WITHOUT ESCAPING! ``` PoC ```python !/usr/bin/env python3 """ XSS test for LibreNMS Custom OID - unit parameter """ import html as html_module import re def strip_tags(value): return re.sub(r']*?>', '', str(value)) Simulate form processing (customoid.inc.php lines 18-21) test_inputs = { 'name': 'alert(1)Test OID', 'oid': '1.3.6.1.4.1.2021.10.1.3.1', 'datatype': 'GAUGE', 'unit': 'alert("XSS")', } name = strip_tags(test_inputs['name']) # Sanitized oid = strip_tags(test_inputs['oid']) # Sanitized datatype = strip_tags(test_inputs['datatype']) # Sanitized unit = test_inputs['unit'] # NOT SANITIZED! print("Input Processing Analysis:") print(f" name (strip_tags): {name}") print(f" oid (strip_tags): {oid}") print(f" datatype (strip_tags): {datatype}") print(f" unit (NO strip_tags): {unit}") print() print("* VULNERABILITY: 'unit' parameter has NO strip_tags()! *") Test XSS payloads payloads = [ 'alert("XSS")', '', '', ] print("\nXSS Payload Tests:") for payload in payloads: escaped = html_module.escape(payload) has_xss = '' in payload or 'onerror=' in payload.lower() print(f" Payload: {payload}") print(f" Raw (vulnerable): Contains executable code: {has_xss}") print(f" Escaped (safe): {escaped}") ``` Expected Output ``` Input Processing Analysis: name (strip_tags): alert(1)Test OID oid (strip_tags): 1.3.6.1.4.1.2021.10.1.3.1 datatype (strip_tags): GAUGE unit (NO strip_tags): alert("XSS") • VULNERABILITY: 'unit' parameter has NO strip_tags()! * ``` Impact • Attack Vector: User with device edit permissions sets malicious Unit value • Exploitation: XSS payload stored in database, executes for all users viewing device graphs • Consequences: • Session hijacking via cookie theft • Admin account takeover • Malicious actions on behalf of victims • Persistent attack affecting all users • Affected Users: All LibreNMS installations with Custom OID feature