CVE-2024-23345: Nautobot has XSS potential in rendered Markdown fields
Impact
All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.
Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:
- Circuit.comments - Cluster.comments - CustomField.description - Device.comments - DeviceRedundancyGroup.comments - DeviceType.comments - Job.description - JobLogEntry.message - Location.comments - Note.note - PowerFeed.comments - Provider.noccontact - Provider.admincontact - Provider.comments - ProviderNetwork.comments - Rack.comments - Tenant.comments - VirtualMachine.comments - Contents of any custom fields of type markdown - Job class description attributes - The SUPPORTMESSAGE system configuration setting
are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.
Patches
Fixed in Nautobot versions 1.6.10 and 2.1.2.
References
https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134
Other sources
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nautobotto a version that resolves this vulnerability.Fixed in 1.6.10 - Upgrade
Upgrade
pip/nautobotto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
nautobotto a version that resolves this vulnerability.Fixed in 1.6.10 - Upgrade
Upgrade
nautobotto a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23345?
CVE-2024-23345 has a moderate severity due to inadequate input sanitization in user-editable Markdown fields.
How do I fix CVE-2024-23345?
To fix CVE-2024-23345, upgrade to Nautobot version 1.6.10 or 2.1.2 or later.
Which versions of Nautobot are affected by CVE-2024-23345?
Nautobot versions earlier than 1.6.10 and 2.1.2 are affected by CVE-2024-23345.
What types of fields are impacted by CVE-2024-23345?
CVE-2024-23345 affects user-editable fields that support Markdown rendering, such as Circuit.comments and Cluster.comments.
Is there a risk of exploitation with CVE-2024-23345?
Yes, CVE-2024-23345 poses a risk of exploitation due to insufficient input sanitization, potentially leading to Markdown-related vulnerabilities.