CVE-2023-50263

Nautobot unauthenticated access

• CVSS 5.3
• CWE-306
• Input Validation and Sanitization
• Remote

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=…` and `/files/download/?name=…` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances. Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability. Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workarounds are available other than applying the patches included in those versions.

CVE

CVE-2023-50263

CWE

CWE-306

CVSS base score

5.3

Published

2023-12-12

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Nautobot to versions 1.6.7 and 2.0.6 or higher

from django.http import HttpResponse
from .models import FileProxy

def get_file(request):
    file_name = request.GET.get('name')
    try:
        file_proxy = FileProxy.objects.get(name=file_name)
        return file_proxy.file.open()
    except FileProxy.DoesNotExist:
        return HttpResponse("File not found.", status=404)

def download_file(request):
    file_name = request.GET.get('name')
    try:
        file_proxy = FileProxy.objects.get(name=file_name)
        response = HttpResponse(file_proxy.file.open(), content_type='application/octet-stream')
        response['Content-Disposition'] = f'attachment; filename="{file_proxy.name}"'
        return response
    except FileProxy.DoesNotExist:
        return HttpResponse("File not found.", status=404)

from django.contrib.auth.decorators import login_required
from django.http import Http404, HttpResponse
from .models import FileProxy

@login_required
def get_file(request):
    file_name = request.GET.get('name')
    try:
        file_proxy = FileProxy.objects.get(name=file_name)
        if not request.user.has_perm('app.view_fileproxy', file_proxy):
            raise Http404("You do not have permission to access this file.")
        return file_proxy.file.open()
    except FileProxy.DoesNotExist:
        raise Http404("File not found.")

@login_required
def download_file(request):
    file_name = request.GET.get('name')
    try:
        file_proxy = FileProxy.objects.get(name=file_name)
        if not request.user.has_perm('app.view_fileproxy', file_proxy):
            raise Http404("You do not have permission to access this file.")
        response = HttpResponse(file_proxy.file.open(), content_type='application/octet-stream')
        response['Content-Disposition'] = f'attachment; filename="{file_proxy.name}"'
        return response
    except FileProxy.DoesNotExist:
        raise Http404("File not found.")

@misc{vaitp:cve202350263,
  title        = {{Nautobot unauthenticated access}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-50263},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-50263/}}
}