starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-13 13:53:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

API tokens are stored in cleartext in the database #10818

New Issue
Closed
opened 2025-12-29 21:36:16 +01:00 by adam · 2 comments
adam commented 2025-12-29 21:36:16 +01:00
Owner
Copy Link

Originally created by @hikhvar on GitHub (Feb 27, 2025).

Deployment Type

Self-hosted

NetBox Version

v4.2.3

Python Version

3.12

Steps to Reproduce

Create an API token via the UI or API.

Then connect to the database and run the following sql to see all tokens in clear text:

SELECT t.key
FROM public.users_token t

Expected Behavior

I expect the tokens to be hashed with a salt in the database, as we do it for passwords. An attacker obtaining a dump of the database (e.g. restoring a backup/finding a dump) can easily now impersonate everyone in the netbox API.

Observed Behavior

The SQL query gives away all tokens in clear text.

Originally created by @hikhvar on GitHub (Feb 27, 2025). ### Deployment Type Self-hosted ### NetBox Version v4.2.3 ### Python Version 3.12 ### Steps to Reproduce Create an API token via the UI or API. Then connect to the database and run the following sql to see all tokens in clear text: ``` SELECT t.key FROM public.users_token t ``` ### Expected Behavior I expect the tokens to be hashed with a salt in the database, as we do it for passwords. An attacker obtaining a dump of the database (e.g. restoring a backup/finding a dump) can easily now impersonate everyone in the netbox API. ### Observed Behavior The SQL query gives away all tokens in clear text.
adam closed this issue 2025-12-29 21:36:16 +01:00
adam commented 2025-12-29 21:36:16 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Feb 27, 2025):

This is by design. Please use the feature request template to propose changes to existing behavior.

@jeremystretch commented on GitHub (Feb 27, 2025): This is by design. Please use the [feature request template](https://github.com/netbox-community/netbox/issues/new?template=01-feature_request.yaml) to propose changes to existing behavior.
adam commented 2025-12-29 21:36:17 +01:00
Author
Owner
Copy Link

@hikhvar commented on GitHub (Feb 27, 2025):

Can I read up the design decision back then? I know this PR when ALLOW_TOKEN_RETRIEVAL was introduced. The thread modelling there where that somebody as access to the shell of netbox. What was not considered back then, that somebody got access to the database or a backup/dumb of that database.

@hikhvar commented on GitHub (Feb 27, 2025): Can I read up the design decision back then? I know this [PR](https://github.com/netbox-community/netbox/issues/8853#issuecomment-1276544219) when ALLOW_TOKEN_RETRIEVAL was introduced. The thread modelling there where that somebody as access to the shell of netbox. What was not considered back then, that somebody got access to the database or a backup/dumb of that database.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#10818
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?