CVE-2024-32979

Nautobot vulnerable to Reflected XSS via improperly handled query parameters.

• CVSS 6.1
• CWE-79
• Input Validation and Sanitization
• Remote

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

CVE

CVE-2024-32979

CWE

CWE-79

CVSS base score

6.1

Published

2024-05-01

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Nautobot

Solution

Upgrade Nautobot to version 1.6.20 or 2.2.3.

def filter_view(request):
    user_input = request.GET.get('filter_param', '')
    response = f"<div>User input: {user_input}</div>"
    return HttpResponse(response)

from django.utils.html import escape

def filter_view(request):
    user_input = request.GET.get('filter_param', '')
    sanitized_input = escape(user_input)
    response = f"<div>User input: {sanitized_input}</div>"
    return HttpResponse(response)

<script>alert('XSS Vulnerability Exploited');</script>

@misc{vaitp:cve202432979,
  title        = {{Nautobot vulnerable to Reflected XSS via improperly handled query parameters.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-32979},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-32979/}}
}