CVE-2023-46128

Nautobot 2.0.x REST API exposes hashed user passwords with ?depth=<N> parameter

• CVSS 6.5
• CWE-312
• Information Leakage
• Remote

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

CVE

CVE-2023-46128

CWE

CWE-312

CVSS base score

6.5

Published

2023-10-25

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to Nautobot version 2.0.3 or higher.

from rest_framework import serializers
from .models import User

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = '__all__'

from rest_framework import viewsets

class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer

    def get_queryset(self):
        return super().get_queryset()

from rest_framework import serializers
from .models import User

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ['id', 'username', 'email']

from rest_framework import viewsets

class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer

    def get_queryset(self):
        depth = self.request.query_params.get('depth', None)
        if depth is not None:
            raise serializers.ValidationError("The 'depth' parameter is not allowed.")
        return super().get_queryset()

@misc{vaitp:cve202346128,
  title        = {{Nautobot 2.0.x REST API exposes hashed user passwords with ?depth=<N> parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-46128},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-46128/}}
}