XXS in Config Revision Create Page from Current Value field (authenticated) - CVE-2024-56916 #10744

New Issue

adam · 2025-12-29T21:35:27+01:00

adam commented

2025-12-29 21:35:27 +01:00

Originally created by @noxlumens on GitHub (Feb 7, 2025).

Deployment Type

Self-hosted

NetBox Version

v4.2.3

Python Version

3.12

Steps to Reproduce

Configuration History > Config Revision > Add

Summary

Once authenticated, the Configuration History > Add endpoint is vulnerable to cross-site scripting (XSS) due to the current value field rendering user supplied html. An authenticated attacker can leverage the Configuration History endpoint by adding malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.

Affected Endpoint:

https://<ADDRESS>/core/config-revisions/add/ > Edit Configuration Window in the Current Value field.

Current Value XSS

Source Code

/netbox/core/forms/model_forms.py

This section does not filter user supplied input in the {value} template field, which allows input to be interpreted as HTML without sanitizing it.

# Set the field's help text
help_text = self.fields[param.name].help_text
if help_text:
	help_text += '<br />'  # Line break
help_text += _('Current value: <strong>{value}</strong>').format(value=value or '&mdash;')
if value == param.default:
	help_text += _(' (default)')
self.fields[param.name].help_text = help_text

Reproduce the Attack

Navigate to https://<ADDRESS>/core/config-revisions/add/
Paste <script>prompt("Current Value XSS")</script> into any banner field
Click "Create"
Navigate to https://<ADDRESS>/core/config-revisions/add/

Expected Behavior

User supplied input is sanitized.

Observed Behavior

Alert box triggered from user supplied input in any field in config revision > add while editing a configuration.

Originally created by @noxlumens on GitHub (Feb 7, 2025). ### Deployment Type Self-hosted ### NetBox Version v4.2.3 ### Python Version 3.12 ### Steps to Reproduce # Configuration History > Config Revision > Add ### *Summary* Once authenticated, the `Configuration History > Add` endpoint is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage the Configuration History endpoint by adding malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger. ### Affected Endpoint: `https://<ADDRESS>/core/config-revisions/add/ > Edit Configuration Window` in the **Current Value** field. **Current Value XSS** ### Source Code `/netbox/core/forms/model_forms.py` This section does not filter user supplied input in the `{value}` template field, which allows input to be interpreted as HTML without sanitizing it. ```html # Set the field's help text help_text = self.fields[param.name].help_text if help_text: help_text += '<br />' # Line break help_text += _('Current value: <strong>{value}</strong>').format(value=value or '—') if value == param.default: help_text += _(' (default)') self.fields[param.name].help_text = help_text ``` ##### Reproduce the Attack 1. Navigate to `https://<ADDRESS>/core/config-revisions/add/` 2. Paste `<script>prompt("Current Value XSS")</script>` into any banner field 3. Click "Create" 4. Navigate to `https://<ADDRESS>/core/config-revisions/add/` ### Expected Behavior User supplied input is sanitized. ### Observed Behavior Alert box triggered from user supplied input in any field in `config revision > add` while editing a configuration. ![Image](https://github.com/user-attachments/assets/6b0d7af0-f9ca-4b5b-ac45-c8534ecb82f0)

adam closed this issue

2025-12-29 21:35:27 +01:00

adam commented

2025-12-29 21:35:28 +01:00

@DanSheps commented on GitHub (Feb 7, 2025):

Please follow the proper disclosure procedure documented here:

https://github.com/netbox-community/netbox/blob/main/SECURITY.md

@DanSheps commented on GitHub (Feb 7, 2025): Please follow the proper disclosure procedure documented here: https://github.com/netbox-community/netbox/blob/main/SECURITY.md

adam referenced this issue

2025-12-29 23:20:14 +01:00

[PR #10744] [MERGED] 10716 add left-right plugins to tags page #13683

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#10744