CVE-2024-47226
📋 TL;DR
A stored XSS vulnerability exists in NetBox 4.1.0's configuration history feature where authenticated users can inject malicious JavaScript/HTML into the 'Top banner' field. This allows attackers to execute arbitrary code in victims' browsers when they view the admin panel. The vulnerability is disputed as the banner field is designed to accept unsanitized HTML for notifications.
💻 Affected Systems
- NetBox
📦 What is this software?
Netbox by Netbox
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious user could steal admin session cookies, perform actions as other users, or redirect users to malicious sites.
Likely Case
Limited impact since exploitation requires authenticated access and the field's purpose is to display HTML, making malicious content potentially obvious.
If Mitigated
Minimal impact if proper access controls limit who can modify configuration revisions and users are trained to recognize suspicious banner content.
🎯 Exploit Status
Exploitation requires authenticated access to the admin panel. The vulnerability is disputed by multiple parties as intended functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch as this is disputed as not a vulnerability. Consider upgrading to latest NetBox version for general security improvements.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit who has authenticated access to the admin panel configuration revision feature.
Monitor Banner Content
allRegularly review configuration revision banners for suspicious HTML/JavaScript content.
🧯 If You Can't Patch
- Implement strict access controls to limit who can modify configuration revisions.
- Educate users to recognize and report suspicious banner content in the admin panel.
🔍 How to Verify
Check if Vulnerable:
Check if running NetBox 4.1.0 and verify if the configuration revision banner field accepts unsanitized HTML input.Check Version:
Check NetBox version in admin interface or via application configuration.Verify Fix Applied:
N/A as no official fix exists due to dispute about vulnerability status.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to configuration revision banners
- Admin panel access from unexpected users
Network Indicators:
- HTTP requests to /core/config-revisions/ with JavaScript payloads
SIEM Query:
Search for POST requests to '/core/config-revisions/' containing script tags or JavaScript patterns.