PT-2023-30913 · Nautobot+1 · Nautobot+1

Published 2023-11-22 · Updated 2023-11-29 · CVE-2023-48705

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.6 Nautobot versions prior to 2.0.5

Description The issue is related to a cross-site scripting vulnerability due to the incorrect usage of Django's mark safe() API when rendering certain types of user-authored content, including custom links, job buttons, and computed fields. This allows users with permission to create or edit these types of content to craft a malicious payload, such as JavaScript code, that would be executed when rendering pages containing this content.

Recommendations For Nautobot versions prior to 1.6.6, upgrade to version 1.6.6. For Nautobot versions prior to 2.0.5, upgrade to version 2.0.5. Apply appropriate object permissions to restrict which users are permitted to create or edit custom links, job buttons, and computed fields.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48705

GHSA-CF9F-WMHP-V4PR

PYSEC-2023-285

Affected Products

Django

Nautobot

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48705.json · Exploit
• https://github.com/nautobot/nautobot/pull/4833 · Patch
• https://github.com/nautobot/nautobot/commit/54abe23331b6c3d0d82bf1b028c679b1d200920d · Patch
• https://github.com/nautobot/nautobot/commit/362850f5a94689a4c75e3188bf6de826c3b012b2 · Patch
• https://github.com/nautobot/nautobot/pull/4832 · Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-cf9f-wmhp-v4pr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48705 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-285 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cf9f-wmhp-v4pr · Vendor Advisory
• https://github.com/nautobot/nautobot · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-285.yaml · Note
• https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe · Note
• https://t.me/cvenotify/61397 · Telegram Post
• https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html · Note