CVE-2024-36112: Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects
Impact What kind of vulnerability is it? Who is impacted?
A user with permissions to view Dynamic Group records (extras.viewdynamicgroup permission) can use the Dynamic Group detail UI view (/extras/dynamic-groups/<uuid>/) and/or the members REST API view (/api/extras/dynamic-groups/<uuid>/members/) to list the objects that are members of a given Dynamic Group.
In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's dcim.viewdevice permissions or lack thereof.
Patches Has the problem been patched? What versions should users upgrade to?
Fixed in Nautobot 1.6.23 and 2.2.5.
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
This vulnerability can be partially mitigated by removing extras.viewdynamicgroup permission from users; a full fix will require upgrading.
References Are there any links users can visit to find out more?
- https://github.com/nautobot/nautobot/pull/5757 - https://github.com/nautobot/nautobot/pull/5762
Other sources
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (extras.viewdynamicgroup permission) can use the Dynamic Group detail UI view (/extras/dynamic-groups/<uuid>/) and/or the members REST API view (/api/extras/dynamic-groups/<uuid>/members/) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's dcim.viewdevice permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing extras.viewdynamicgroup permission from users however a full fix will require upgrading.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36112?
CVE-2024-36112 has been assessed as a medium severity vulnerability.
What systems are affected by CVE-2024-36112?
CVE-2024-36112 affects Nautobot versions between 1.3.0 and 1.6.23, as well as versions 2.0.0 to 2.2.5.
How do I fix CVE-2024-36112?
To mitigate CVE-2024-36112, upgrade to Nautobot version 1.6.24 or 2.2.6 or later.
What type of vulnerability is CVE-2024-36112?
CVE-2024-36112 is a privilege escalation vulnerability related to Dynamic Group records in Nautobot.
Who is impacted by CVE-2024-36112?
Users with the `extras.view_dynamicgroup` permission in Nautobot are impacted by CVE-2024-36112.