PT-2023-31867 · Nautobot · Nautobot

Abdikanipd · Published 2023-12-22 · Updated 2024-01-03 · CVE-2023-51649

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.8 Nautobot versions prior to 2.1.0

Description Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.run job permission is checked. Object-level permissions are not enforced by the URL/view used in this case, specifically the /extras/job-button/<uuid>/run/ endpoint. The effect is that a user with permissions to run even a single Job can actually run all configured JobButton Jobs. This vulnerability only applies to JobButtonReceiver subclasses.

Recommendations For Nautobot versions prior to 1.6.8, upgrade to version 1.6.8 to resolve the issue. For Nautobot versions prior to 2.1.0, upgrade to version 2.1.0 to resolve the issue. As a temporary workaround, consider auditing JobButtonReceiver subclasses defined in the system and restricting which users are permitted to create or edit JobButton records.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-51649

GHSA-VF5M-XRHM-V999

PYSEC-2023-287

Affected Products

Nautobot

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51649.json · Exploit
• https://github.com/nautobot/nautobot/pull/4995 · Patch
• https://github.com/nautobot/nautobot/pull/4993 · Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-287 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf5m-xrhm-v999 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51649 · Security Note
• https://github.com/nautobot/nautobot · Note
• https://github.com/nautobot/nautobot/commit/d33d0c15a36948c45244e5b5e10bc79b8e62de7f · Note
• https://github.com/nautobot/nautobot/commit/3d964f996f4926126c1d7853ca87b2ff475997a2 · Note
• https://github.com/nautobot/nautobot/issues/4988 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-287.yaml · Note
• https://twitter.com/VulmonFeeds/status/1738286065096544398 · Twitter Post
• https://t.me/cvenotify/66105 · Telegram Post