CVE-2023-51649

Object-level permission bypass in Nautobot JobButton Jobs prior to 1.6.8 and 2.1.0

• CVSS 4.3
• CWE-863 Incorrect Authorization
• Authentication, Authorization, and Session Management
• Remote

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

CVE

CVE-2023-51649

CWE

CWE-863 Incorrect Authorization

CVSS base score

4.3

Published

2023-12-22

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Nautobot to versions 1.6.8 and 2.1.0 or later

from django.contrib.auth.mixins import LoginRequiredMixin
from nautobot.extras.views import JobView

class JobButtonView(LoginRequiredMixin, JobView):
    def post(self, request, *args, **kwargs):
        if request.user.has_perm('extras.run_job'):
            return self.run_job()
        else:
            return self.permission_denied()

from django.contrib.auth.mixins import LoginRequiredMixin, PermissionRequiredMixin
from django.shortcuts import get_object_or_404
from nautobot.extras.models import Job
from nautobot.extras.views import JobView

class JobButtonView(LoginRequiredMixin, PermissionRequiredMixin, JobView):
    permission_required = 'extras.run_job'
    
    def has_permission(self):
        job = get_object_or_404(Job, pk=self.kwargs['job_id'])
        return super().has_permission() and self.request.user.has_perm('extras.run_job', job)

@misc{vaitp:cve202351649,
  title        = {{Object-level permission bypass in Nautobot JobButton Jobs prior to 1.6.8 and 2.1.0}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-51649},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-51649/}}
}