starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Server-Side Template Injection in webhooks, export templates and custom links. #5162

New Issue
Closed
opened 2025-12-29 19:24:56 +01:00 by adam · 5 comments
adam commented 2025-12-29 19:24:56 +01:00
Owner
Copy Link

Originally created by @kkthxbye-code on GitHub (Aug 9, 2021).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v.2.11.10

Python version

3.8

Steps to Reproduce

  1. Create a site
  2. Create export template for sites
  3. Fill out required fields
  4. Enter {{ ''.__class__.__mro__[1].__subclasses__()[199]('id', shell=True,stdout=-1).communicate()}} in template code. Indexes for mro and subclasses will probably differ per instance.
  5. Go to sites and execute the export template
  6. Open generated csv file

Expected Behavior

Error or default csv file generated

Observed Behavior

.csv file contains (b'uid=101 gid=0(root)\n', None)

Suggestions

I see two immediate options.

  1. Make it clear in the documentation that having rights to create webhooks, export templates or custom links is dangerous and allows RCE on the host.
  2. Use the jinja2 sandbox: https://jinja.palletsprojects.com/en/3.0.x/sandbox/

With option 2 there should probably still be a note in the documentation, as sandboxes are rarely known to be perfect.

Originally created by @kkthxbye-code on GitHub (Aug 9, 2021). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v.2.11.10 ### Python version 3.8 ### Steps to Reproduce 1. Create a site 2. Create export template for sites 3. Fill out required fields 4. Enter `{{ ''.__class__.__mro__[1].__subclasses__()[199]('id', shell=True,stdout=-1).communicate()}}` in `template code`. Indexes for __mro__ and __subclasses__ will probably differ per instance. 5. Go to sites and execute the export template 6. Open generated csv file ### Expected Behavior Error or default csv file generated ### Observed Behavior .csv file contains `(b'uid=101 gid=0(root)\n', None)` ### Suggestions I see two immediate options. 1. Make it clear in the documentation that having rights to create webhooks, export templates or custom links is dangerous and allows RCE on the host. 2. Use the jinja2 sandbox: https://jinja.palletsprojects.com/en/3.0.x/sandbox/ With option 2 there should probably still be a note in the documentation, as sandboxes are rarely known to be perfect.
adam added the type: bugstatus: accepted labels 2025-12-29 19:24:56 +01:00
adam closed this issue 2025-12-29 19:24:56 +01:00
adam commented 2025-12-29 19:24:57 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 9, 2021):

This is a pretty well-known issue with Jinja2 other templating engines in general. We could add some form of additional warning, I guess, though it may be difficult to succinctly convey the relative risk. Given that only authenticated users who have been specifically granted access can create these objects in the first place, it's probably not a huge concern.

The sandbox is a neat idea, but we'll need to dig into it more to see if there are any blockers.

@jeremystretch commented on GitHub (Aug 9, 2021): This is a pretty [well-known issue](https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2/) with Jinja2 other templating engines in general. We could add some form of additional warning, I guess, though it may be difficult to succinctly convey the relative risk. Given that only authenticated users who have been specifically granted access can create these objects in the first place, it's probably not a huge concern. The sandbox is a neat idea, but we'll need to dig into it more to see if there are any blockers.
adam commented 2025-12-29 19:24:57 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 9, 2021):

.csv file contains (b'uid=101 gid=0(root)\n', None)

By the way, you shouldn't be running NetBox as a member of the root group. The installation docs recommend creating a unique netbox user with its own group.

@jeremystretch commented on GitHub (Aug 9, 2021): > .csv file contains `(b'uid=101 gid=0(root)\n', None)` By the way, you shouldn't be running NetBox as a member of the `root` group. The [installation docs](https://netbox.readthedocs.io/en/stable/installation/3-netbox/#create-the-netbox-system-user) recommend creating a unique `netbox` user with its own group.
adam commented 2025-12-29 19:24:57 +01:00
Author
Owner
Copy Link

@kkthxbye-code commented on GitHub (Aug 9, 2021):

By the way, you shouldn't be running NetBox as a member of the root group.

It's not a production system, it's a completely clean run of netbox-docker. I also run docker with user namespaces, so it doesn't even map to the root group on the host. Anyway, not sure why they change the user and not the group in the compose file.

@kkthxbye-code commented on GitHub (Aug 9, 2021): >By the way, you shouldn't be running NetBox as a member of the root group. It's not a production system, it's a completely clean run of [netbox-docker](https://github.com/netbox-community/netbox-docker). I also run docker with user namespaces, so it doesn't even map to the root group on the host. Anyway, not sure why they change the user and not the group in the compose file.
adam commented 2025-12-29 19:24:57 +01:00
Author
Owner
Copy Link

@sdktr commented on GitHub (Aug 9, 2021):

By the way, you shouldn't be running NetBox as a member of the root group.

It's not a production system, it's a completely clean run of netbox-docker. I also run docker with user namespaces, so it doesn't even map to the root group on the host. Anyway, not sure why they change the user and not the group in the compose file.

Let's open an issue on the netbox-docker to discuss the user/group assignments/mappings when running netbox in a container

Edit: not the first permission related issue in netbox-docker. Check this enhancement: https://github.com/netbox-community/netbox-docker/pull/546

@sdktr commented on GitHub (Aug 9, 2021): > >By the way, you shouldn't be running NetBox as a member of the root group. > > > > It's not a production system, it's a completely clean run of [netbox-docker](https://github.com/netbox-community/netbox-docker). I also run docker with user namespaces, so it doesn't even map to the root group on the host. Anyway, not sure why they change the user and not the group in the compose file. Let's open an issue on the netbox-docker to discuss the user/group assignments/mappings when running netbox in a container Edit: not the first permission related issue in netbox-docker. Check this enhancement: https://github.com/netbox-community/netbox-docker/pull/546
adam commented 2025-12-29 19:24:58 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 11, 2021):

I've updated the render_jinja2() we use for all Jinja2 code to employ the SandboxedEnvironment as suggested, and updated the relevant documentation to call out the relative risks of allowing user-submitted code.

@jeremystretch commented on GitHub (Aug 11, 2021): I've updated the `render_jinja2()` we use for all Jinja2 code to employ the SandboxedEnvironment as suggested, and updated the relevant documentation to call out the relative risks of allowing user-submitted code.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5162
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?