CVE-2023-48705
📋 TL;DR
Nautobot versions before 1.6.6 and 2.0.5 contain a stored cross-site scripting vulnerability in user-authored content rendering. Users with permission to create/edit custom links, job buttons, or computed fields can inject malicious JavaScript that executes when other users view pages containing that content. All Nautobot deployments using affected versions are potentially vulnerable.
💻 Affected Systems
- Nautobot
📦 What is this software?
Nautobot by Networktocode
Nautobot by Networktocode
⚠️ Risk & Real-World Impact
Worst Case
Privileged user with content creation permissions could inject malicious JavaScript that steals admin credentials, performs administrative actions, or compromises user sessions across the organization.
Likely Case
Malicious insider or compromised account with appropriate permissions could inject JavaScript to steal session cookies, redirect users to phishing sites, or perform unauthorized actions within the application.
If Mitigated
With proper object permissions restricting who can create/edit user-authored content, only trusted administrators could exploit this, limiting potential damage.
🎯 Exploit Status
Exploitation requires authenticated user with permissions to create/edit custom links, job buttons, or computed fields. The vulnerability is in template rendering logic, making exploitation straightforward for users with appropriate access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.6 for 1.6.x LTM, 2.0.5 for 2.0.x
Vendor Advisory: https://github.com/nautobot/nautobot/security/advisories
Restart Required: Yes
Instructions:
1. Backup your Nautobot database and configuration. 2. Stop Nautobot services. 3. Upgrade using pip: 'pip install nautobot==1.6.6' for 1.6.x or 'pip install nautobot==2.0.5' for 2.0.x. 4. Run database migrations: 'nautobot-server migrate'. 5. Restart Nautobot services.
🔧 Temporary Workarounds
Restrict Content Creation Permissions
allApply strict object permissions to limit which users can create/edit custom links, job buttons, and computed fields.
Configure via Nautobot admin interface: Admin > Permissions > Object Permissions
🧯 If You Can't Patch
- Implement strict object permissions to limit content creation/edit capabilities to only essential administrators
- Monitor audit logs for suspicious content creation/modification activities and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check Nautobot version: 'nautobot-server --version' or examine package version in Python environmentCheck Version:
nautobot-server --versionVerify Fix Applied:
Verify version is 1.6.6 or higher (for 1.6.x) or 2.0.5 or higher (for 2.0.x) and test that user-authored content is properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual patterns in custom link/job button/computed field creation/modification
- Multiple content creation events from single user in short timeframe
Network Indicators:
- Unexpected JavaScript execution in Nautobot pages
- External resource loading from Nautobot interface
SIEM Query:
source="nautobot" AND (event="create_customlink" OR event="modify_customlink" OR event="create_jobbutton" OR event="modify_jobbutton") | stats count by user🔗 References
- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html
- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe
- https://github.com/nautobot/nautobot/commit/362850f5a94689a4c75e3188bf6de826c3b012b2
- https://github.com/nautobot/nautobot/commit/54abe23331b6c3d0d82bf1b028c679b1d200920d
- https://github.com/nautobot/nautobot/pull/4832
- https://github.com/nautobot/nautobot/pull/4833
- https://github.com/nautobot/nautobot/security/advisories/GHSA-cf9f-wmhp-v4pr
- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html
- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe
- https://github.com/nautobot/nautobot/commit/362850f5a94689a4c75e3188bf6de826c3b012b2
- https://github.com/nautobot/nautobot/commit/54abe23331b6c3d0d82bf1b028c679b1d200920d
- https://github.com/nautobot/nautobot/pull/4832
- https://github.com/nautobot/nautobot/pull/4833
- https://github.com/nautobot/nautobot/security/advisories/GHSA-cf9f-wmhp-v4pr
