PT-2024-25026 · Nautobot · Nautobot

Michaelpanorios · Published 2024-05-01 · Updated 2024-05-02 · CVE-2024-32979

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.20 Nautobot versions prior to 2.2.3

Description A Reflected Cross-Site Scripting (Reflected XSS) attack can be executed against users due to improper handling and escaping of user-provided query parameters in Nautobot. All filterable object-list views in Nautobot are vulnerable, including various API endpoints such as "/dcim/location-types/", "/dcim/locations/", "/dcim/racks/", and many others.

Recommendations For versions prior to 1.6.20, update to version 1.6.20 or later. For versions prior to 2.2.3, update to version 2.2.3 or later. As a temporary workaround, consider restricting access to filterable object-list views until a patch is applied. Avoid using user-provided query parameters in affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32979

GHSA-JXGR-GCJ5-CQQG

Affected Products

Nautobot

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32979.json · Exploit
• https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e · Patch
• https://github.com/nautobot/nautobot/pull/5646 · Patch
• https://github.com/nautobot/nautobot/pull/5647 · Patch
• https://osv.dev/vulnerability/CVE-2024-32979 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jxgr-gcj5-cqqg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32979 · Security Note
• https://github.com/nautobot/nautobot · Note
• https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg · Note
• https://github.com/nautobot/nautobot/releases/tag/v1.6.20 · Note
• https://github.com/nautobot/nautobot/releases/tag/v2.2.3 · Note
• https://github.com/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146 · Note
• https://twitter.com/linuxpatch/status/1785641898507383279 · Twitter Post
• https://twitter.com/oktsec/status/1785678779844587684 · Twitter Post
• https://t.me/cvenotify/78673 · Telegram Post