starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

DOM-based XSS vulnerability in search export link #11443

New Issue
Closed
opened 2025-12-29 21:45:18 +01:00 by adam · 1 comment
adam commented 2025-12-29 21:45:18 +01:00
Owner
Copy Link

Originally created by @jnovinger on GitHub (Aug 1, 2025).

Originally assigned to: @jnovinger on GitHub.

Deployment Type

Self-hosted

NetBox Version

v4.3.5

Python Version

3.10

Steps to Reproduce

  1. Navigate to a NetBox list view with search and export functionality

    • Go to /dcim/devices/ or any other object list view
    • Ensure you can see both the search box and "Export" button/link

  2. Enter a malicious search query containing URL-breaking characters

    • In the search box, enter: test&malicious=injected<script>alert('xss')</script>
    • Press Enter or click search

  3. Inspect the Export link

    • Right-click on the "Export Current View" link
    • Select "Inspect Element" or "Copy Link Address"
    • Observe the href attribute contains unencoded malicious input

  4. Verify the vulnerability

    • The href should contain: ...&q=test&malicious=injected<script>alert('xss')</script>
    • Notice the search parameter is not URL-encoded
    • The &malicious=injected creates an additional URL parameter
    • The <script> tags are present in raw form

  5. Confirm exploitation potential

    • Copy the malicious export URL
    • Paste into browser address bar
    • Depending on how the export endpoint processes the URL, the XSS payload could execute

Expected Behavior

User input in search parameters should be properly URL-encoded before being added to export links to prevent XSS vulnerabilities.

Observed Behavior

Raw user input is concatenated directly into the export link URL without encoding.

Originally created by @jnovinger on GitHub (Aug 1, 2025). Originally assigned to: @jnovinger on GitHub. ### Deployment Type Self-hosted ### NetBox Version v4.3.5 ### Python Version 3.10 ### Steps to Reproduce 1. **Navigate to a NetBox list view with search and export functionality** - Go to `/dcim/devices/` or any other object list view - Ensure you can see both the search box and "Export" button/link 2. **Enter a malicious search query containing URL-breaking characters** - In the search box, enter: `test&malicious=injected<script>alert('xss')</script>` - Press Enter or click search 3. **Inspect the Export link** - Right-click on the "Export Current View" link - Select "Inspect Element" or "Copy Link Address" - Observe the href attribute contains unencoded malicious input 4. **Verify the vulnerability** - The href should contain: `...&q=test&malicious=injected<script>alert('xss')</script>` - Notice the search parameter is not URL-encoded - The `&malicious=injected` creates an additional URL parameter - The `<script>` tags are present in raw form 5. **Confirm exploitation potential** - Copy the malicious export URL - Paste into browser address bar - Depending on how the export endpoint processes the URL, the XSS payload could execute ### Expected Behavior User input in search parameters should be properly URL-encoded before being added to export links to prevent XSS vulnerabilities. ### Observed Behavior Raw user input is concatenated directly into the export link URL without encoding.
adam added the type: bugstatus: acceptedseverity: low labels 2025-12-29 21:45:18 +01:00
adam closed this issue 2025-12-29 21:45:18 +01:00
adam commented 2025-12-29 21:45:19 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 4, 2025):

Depending on how the export endpoint processes the URL, the XSS payload could execute

FWIW I have not been able to reproduce this as an XSS.

@jeremystretch commented on GitHub (Aug 4, 2025): > Depending on how the export endpoint processes the URL, the XSS payload could execute FWIW I have not been able to reproduce this as an XSS.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label severity: low status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#11443
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?