LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Summary

The Oxidized integration URL (oxidized.url) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (name, ip, model, author, commit message) into HTML without htmlspecialchars(). An admin pointing the URL at an attacker-controlled server achieves persistent XSS affecting all users who view any device's showconfig tab.

CVSS

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N — 8.1 High

Details

// includes/html/pages/device/showconfig.inc.php:276-278
echo 'Node: ' . $node_info['name'] . '';
echo 'IP: '   . $node_info['ip']   . '';
echo 'Model: '. $node_info['model'] . '';
// lines 349, 353: author and commit message also unescaped