starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Stored Cross Site Scripting Vulnerability in "Configuration History" function in Netbox 4.1.6 #10490

New Issue
Closed
opened 2025-12-29 21:32:11 +01:00 by adam · 2 comments
adam commented 2025-12-29 21:32:11 +01:00
Owner
Copy Link

Originally created by @tu3n4nh on GitHub (Nov 19, 2024).

Deployment Type

Self-hosted

Triage priority

I volunteer to perform this work (if approved)

NetBox Version

v4.1.6

Python Version

3.12

Steps to Reproduce

Version: 4.1.6

Description:

An authenticated malicious user can take advantage of a Stored XSS vulnerability in "Configuration History" function in the "Admin" feature.

Proof of Concept:

Step 1: Go to /core/config-revisions/, click "Add" and insert payload "<script>alert(document.domain)</script>" in "Top banner" field.

image

Step 2: Click "Create".

image

Step 3: Script excuted.

image

Expected Behavior

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
image

Observed Behavior

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
image

Originally created by @tu3n4nh on GitHub (Nov 19, 2024). ### Deployment Type Self-hosted ### Triage priority I volunteer to perform this work (if approved) ### NetBox Version v4.1.6 ### Python Version 3.12 ### Steps to Reproduce # Version: 4.1.6 ## Description: An authenticated malicious user can take advantage of a Stored XSS vulnerability in "Configuration History" function in the "Admin" feature. ## Proof of Concept: ### Step 1: Go to `/core/config-revisions/`, click "Add" and insert payload "`<script>alert(document.domain)</script>`" in "Top banner" field. ![image](https://github.com/user-attachments/assets/74931794-0fb8-44c3-acc8-65a77e927972) ### Step 2: Click "Create". ![image](https://github.com/user-attachments/assets/71b399ce-c783-454c-93ea-db40fda46adc) ### Step 3: Script excuted. ![image](https://github.com/user-attachments/assets/d2b3ab95-8c27-41c4-89b4-280e781c64df) ### Expected Behavior If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. ![image](https://github.com/user-attachments/assets/d2b3ab95-8c27-41c4-89b4-280e781c64df) ### Observed Behavior If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. ![image](https://github.com/user-attachments/assets/d2b3ab95-8c27-41c4-89b4-280e781c64df)
adam added the type: bug label 2025-12-29 21:32:11 +01:00
adam closed this issue 2025-12-29 21:32:11 +01:00
adam commented 2025-12-29 21:32:12 +01:00
Author
Owner
Copy Link

@bctiemann commented on GitHub (Dec 9, 2024):

@tu3n4nh this seems potentially fairly serious; do you have a solution planned for the near future?

@bctiemann commented on GitHub (Dec 9, 2024): @tu3n4nh this seems potentially fairly serious; do you have a solution planned for the near future?
adam commented 2025-12-29 21:32:13 +01:00
Author
Owner
Copy Link

@bctiemann commented on GitHub (Dec 9, 2024):

Actually on further review, this is expected behavior/functionality. Authenticated admin users need to have the ability to insert arbitrary HTML; that's the purpose of the feature. Also I don't think this is cross-site scripting related (i.e. a malicious script that can be inserted into variable content by an untrusted/non-admin user), it's just an inherent risk of the admin account on NetBox or any site being compromised. It's the admin's responsibility to keep their accounts well secured.

I thought this might be a duplicate of another similar issue but wasn't able to find one.

@bctiemann commented on GitHub (Dec 9, 2024): Actually on further review, this is expected behavior/functionality. Authenticated admin users need to have the ability to insert arbitrary HTML; that's the purpose of the feature. Also I don't think this is cross-site scripting related (i.e. a malicious script that can be inserted into variable content by an untrusted/non-admin user), it's just an inherent risk of the admin account on NetBox or any site being compromised. It's the admin's responsibility to keep their accounts well secured. I thought this might be a duplicate of another similar issue but wasn't able to find one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#10490
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?