PT-2023-31867 · Nautobot · Nautobot

Abdikanipd · Publicado 2023-12-22 · Atualizado 2024-01-03 · CVE-2023-51649

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.8 Nautobot versions prior to 2.1.0

Description Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.run job permission is checked. Object-level permissions are not enforced by the URL/view used in this case, specifically the /extras/job-button/<uuid>/run/ endpoint. The effect is that a user with permissions to run even a single Job can actually run all configured JobButton Jobs. This vulnerability only applies to JobButtonReceiver subclasses.

Recommendations For Nautobot versions prior to 1.6.8, upgrade to version 1.6.8 to resolve the issue. For Nautobot versions prior to 2.1.0, upgrade to version 2.1.0 to resolve the issue. As a temporary workaround, consider auditing JobButtonReceiver subclasses defined in the system and restricting which users are permitted to create or edit JobButton records.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-51649

GHSA-VF5M-XRHM-V999

PYSEC-2023-287

Produtos afetados

Nautobot

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51649.json · Exploit
• https://github.com/nautobot/nautobot · Nota
• https://github.com/nautobot/nautobot/pull/4995 · Correção
• https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999 · Aviso do Fabricante
• https://github.com/nautobot/nautobot/pull/4993 · Correção
• https://github.com/nautobot/nautobot/issues/4988 · Nota
• https://github.com/nautobot/nautobot/commit/3d964f996f4926126c1d7853ca87b2ff475997a2 · Nota
• https://github.com/nautobot/nautobot/commit/d33d0c15a36948c45244e5b5e10bc79b8e62de7f · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-287.yaml · Nota
• https://twitter.com/VulmonFeeds/status/1738286065096544398 · Publicação no Twitter
• https://osv.dev/vulnerability/PYSEC-2023-287 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-51649 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vf5m-xrhm-v999 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-51649 · Nota de Segurança
• https://t.me/cvenotify/66105 · Publicação no Telegram