PT-2024-19824 · Nautobot · Nautobot

Kircheneer · Published 2024-01-22 · Updated 2024-01-29 · CVE-2024-23345

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.10 Nautobot versions prior to 2.1.2

Description Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. The affected fields include Circuit.comments, Cluster.comments, CustomField.description, Device.comments, DeviceRedundancyGroup.comments, DeviceType.comments, Job.description, JobLogEntry.message, Location.comments, Note.note, PowerFeed.comments, Provider.noc contact, Provider.admin contact, Provider.comments, ProviderNetwork.comments, Rack.comments, Tenant.comments, VirtualMachine.comments, contents of any custom fields of type markdown, job class description attributes, and the SUPPORT MESSAGE system configuration setting.

Recommendations For Nautobot versions prior to 1.6.10, update to version 1.6.10 or later to resolve the issue. For Nautobot versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to user-editable fields that support Markdown rendering until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-23345

GHSA-V4XV-795H-RV4H

PYSEC-2024-16

Affected Products

Nautobot

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23345.json · Exploit
• https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80 · Patch
• https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce · Patch
• https://github.com/nautobot/nautobot/pull/5133 · Patch
• https://github.com/nautobot/nautobot/pull/5134 · Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23345 · Security Note
• https://osv.dev/vulnerability/GHSA-v4xv-795h-rv4h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23345 · Vendor Advisory
• https://github.com/nautobot/nautobot · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2024-16.yaml · Note
• https://t.me/cvenotify/68269 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1749607236484083792 · Twitter Post
• https://twitter.com/CVEnew/status/1749574551799755219 · Twitter Post