XXS in Maintenance Banner (authenticated) - CVE-2024-56917 #10741

New Issue

adam · 2025-12-29T21:35:25+01:00

adam commented

2025-12-29 21:35:25 +01:00

Originally created by @noxlumens on GitHub (Feb 7, 2025).

Deployment Type

Self-hosted

NetBox Version

v4.2.3

Python Version

3.12

Steps to Reproduce

XXS in Maintenance Banner

Proof Of Concept

Summary

An attacker can edit https://<ADDRESS>/core/config-revisions/add/ > maintenance banner with malicious JavaScript. Once authenticated, all internal endpoints are vulnerable to cross-site scripting (XSS) due to the maintenance banner warnings. An authenticated attacker can leverage the Configuration History endpoint by adding malicious JavaScript to the maintenance banner and putting the application into "Maintenance mode".

Access Required

authenticated administrative access
authenticated access with the permission "Object types" Core > Config Revision with Actions Can view, Can add, Can change

Affected Endpoints:

https://<ADDRESS>/*

Source Code

This section uses the Django {% trans message %} in /netbox/templates/inc/alert/warning.html, which allows user-defined input to be interpreted as HTML without sanitizing it.

<div>
  <h4 class="alert-title">{% block title %}{% trans title %}{% endblock %}</h4>
  {% block content %}
	<div class="text-secondary">{% trans message %}</div>
  {% endblock content %}
</div>

An authenticated and permissioned attacker needs to edit https://<ADDRESS>/core/config-revisions/add/ > maintenance banner with malicious JavaScript and enable maintenance mode. Once enabled, all endpoints with the maintenance banner are vulnerable

Reproduce the Attack

Navigate to https://<ADDRESS>/core/config-revisions/add/
Paste <script>prompt("Maintenance Banner XSS")</script> into the Maintenance banner field
Check the "Maintenance Mode" checkbox.
Click "Create"
All endpoints that support the Maintenance Warning will prompt.

Expected Behavior

User input should be sanitized.

Observed Behavior

Cross-site scripting rendered on endpoints with the maintenance banner.

Originally created by @noxlumens on GitHub (Feb 7, 2025). ### Deployment Type Self-hosted ### NetBox Version v4.2.3 ### Python Version 3.12 ### Steps to Reproduce # XXS in Maintenance Banner [Proof Of Concept](https://youtu.be/GC8-PUlu2i8?t=175) ### *Summary* An attacker can edit `https://<ADDRESS>/core/config-revisions/add/ > maintenance banner` with malicious JavaScript. Once authenticated, all internal endpoints are vulnerable to cross-site scripting (XSS) due to the maintenance banner warnings. An authenticated attacker can leverage the Configuration History endpoint by adding malicious JavaScript to the maintenance banner and putting the application into "Maintenance mode". ### Access Required - authenticated administrative access - authenticated access with the permission "Object types" `Core > Config Revision` with Actions `Can view`, `Can add`, `Can change` ![Image](https://github.com/user-attachments/assets/061c880c-3173-4266-8ce5-9fce021523ea) ### Affected Endpoints: `https://<ADDRESS>/*` ### Source Code This section uses the Django `{% trans message %}` in `/netbox/templates/inc/alert/warning.html`, which allows user-defined input to be interpreted as HTML without sanitizing it. ```html <div> <h4 class="alert-title">{% block title %}{% trans title %}{% endblock %}</h4> {% block content %} <div class="text-secondary">{% trans message %}</div> {% endblock content %} </div> ``` An authenticated and permissioned attacker needs to edit `https://<ADDRESS>/core/config-revisions/add/ > maintenance banner` with malicious JavaScript and enable maintenance mode. Once enabled, all endpoints with the maintenance banner are vulnerable ###### Reproduce the Attack 1. Navigate to `https://<ADDRESS>/core/config-revisions/add/` 2. Paste `<script>prompt("Maintenance Banner XSS")</script>` into the Maintenance banner field 3. Check the "Maintenance Mode" checkbox. 4. Click "Create" All endpoints that support the Maintenance Warning will prompt. ![Image](https://github.com/user-attachments/assets/9ab8828d-dbb5-4271-b3d0-e9dce28c844b) ### Expected Behavior User input should be sanitized. ### Observed Behavior Cross-site scripting rendered on endpoints with the maintenance banner. ![Image](https://github.com/user-attachments/assets/c0841bbf-11ef-4ca2-a3b6-1eb4631d0b0d)

adam closed this issue

2025-12-29 21:35:25 +01:00

adam commented

2025-12-29 21:35:26 +01:00

@DanSheps commented on GitHub (Feb 7, 2025):

Please follow the proper disclosure procedure here:

https://github.com/netbox-community/netbox/blob/main/SECURITY.md

@DanSheps commented on GitHub (Feb 7, 2025): Please follow the proper disclosure procedure here: https://github.com/netbox-community/netbox/blob/main/SECURITY.md

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#10741