Cross-site Scripting potential in custom links, job buttons, and computed fields

CVE-2023-48705 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Impact

All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected.

Due to incorrect usage of Django's mark_safe() API when rendering certain types of user-authored content, including:

  • custom links
  • job buttons
  • computed fields

it is possible that users with permission to create or edit these types of content could craft a malicious payload (such as JavaScript code) that would be executed when rendering pages containing this content.

Patches

Has the problem been patched? What versions should users upgrade to?

We have fixed the incorrect uses of mark_safe() (generally by replacing them with appropriate use of format_html() instead) to prevent such malicious data from being executed.

Users on Nautobot 1.6.x LTM should upgrade to v1.6.6 and users on Nautobot 2.0.x should upgrade to v2.0.5.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Appropriate object permissions can and should be applied to restrict which users are permitted to create or edit the aforementioned types of user-authored content. Other than that, there is no direct fix available.

References

Are there any links users can visit to find out more?

  • https://github.com/nautobot/nautobot/pull/4832
  • https://github.com/nautobot/nautobot/pull/4833
  • https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html
  • https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe

Basic information

Type
reviewed
Severity
high
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2023-11-22 20:55:54 UTC
Updated
2024-11-22 18:13:44 UTC
GitHub reviewed
2023-11-22 20:55:54 UTC
NVD published
2023-11-22

EPSS Score

Score Percentile
0.29% 52.51%

CVSS Scores

Base score Version Severity Vector
7.1 3.1 —
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.

Identifiers

Type Value
GHSA GHSA-cf9f-wmhp-v4pr ↗
CVE CVE-2023-48705 ↗

CWEs

CWE id Name
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
pip nautobot < 1.6.6 1.6.6 —
pip nautobot >= 2.0.0, < 2.0.5 2.0.5 —

References

cvelogic Threat Intelligence