PT-2024-26121 · Nautobot · Nautobot

Michaelpanorios · Published 2024-05-13 · Updated 2025-08-26 · CVE-2024-34707

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.22 Nautobot versions prior to 2.2.4

Description A Nautobot user with admin privileges can modify the BANNER TOP, BANNER BOTTOM, and BANNER LOGIN configuration settings via the "/admin/constance/config/" endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of BANNER LOGIN) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).

Recommendations For Nautobot versions prior to 1.6.22 and 2.2.4, upgrade to version 1.6.22 or 2.2.4 to fix the issue. As a temporary workaround, add the following configuration to the nautobot config.py or equivalent Nautobot configuration file:

BANNER LOGIN = " "
BANNER TOP = " "
BANNER BOTTOM = " "

Alternatively, for Nautobot 2.x, set the following environment variables for the Nautobot user account:

NAUTOBOT BANNER LOGIN=" "
NAUTOBOT BANNER TOP=" "
NAUTOBOT BANNER BOTTOM=" "

Limiting all users who do not need elevated privileges to non-admin access (is superuser: False and is staff: False) is a partial mitigation as well.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34707

GHSA-R2HR-4V48-FJV3

Affected Products

Nautobot

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34707.json · Exploit
• https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c · Patch
• https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423 · Patch
• https://github.com/nautobot/nautobot/pull/5697 · Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3 · Vendor Advisory
• https://github.com/nautobot/nautobot/pull/5698 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-34707 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34707 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r2hr-4v48-fjv3 · Vendor Advisory
• https://github.com/nautobot/nautobot · Note
• https://t.me/cveNotify/133499 · Telegram Post