LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

Summary

Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device (via compromised SNMP agent or syslog sender) can inject arbitrary JavaScript that executes when any authenticated LibreNMS user views the affected pages.

Vulnerable Code

Location 1: Syslog program field (clearest instance)

File: includes/html/print-syslog.inc.php:11,13

$syslog_output .= '' . $entry['program'] . ' :  ' . htmlspecialchars((string) $entry['msg']) . '';