starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-12 05:20:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

XSS in markdown rendering #5639

New Issue
Closed
opened 2025-12-29 19:30:25 +01:00 by adam · 14 comments
adam commented 2025-12-29 19:30:25 +01:00
Owner
Copy Link

Originally created by @SoufElhabti on GitHub (Nov 9, 2021).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v3.0.9

Python version

3.8

Steps to Reproduce

  1. installed Netbox from docker https://hub.docker.com/r/netboxcommunity/netbox/
  2. use any input that accepts markdown
  3. submit this payload :
[37qpypz37qpypz37qpypz37qpypz37qpypz]  
37qpypz37qpypz37qpypz37qpypz37qpypz]: javascript:alert(1)
  1. when the submiting the for click the link and the xss will fire up

Expected Behavior

the payload is dangerous and allowing XSS attack

Observed Behavior

executing javascript in admin dashboard

Originally created by @SoufElhabti on GitHub (Nov 9, 2021). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v3.0.9 ### Python version 3.8 ### Steps to Reproduce 1. installed Netbox from docker `https://hub.docker.com/r/netboxcommunity/netbox/` 2. use any input that accepts markdown 3. submit this payload : ``` [37qpypz37qpypz37qpypz37qpypz37qpypz] 37qpypz37qpypz37qpypz37qpypz37qpypz]: javascript:alert(1) ``` 4. when the submiting the for click the link and the xss will fire up ### Expected Behavior the payload is dangerous and allowing XSS attack ### Observed Behavior executing javascript in admin dashboard
adam added the type: bugstatus: accepted labels 2025-12-29 19:30:25 +01:00
adam closed this issue 2025-12-29 19:30:25 +01:00
adam commented 2025-12-29 19:30:25 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Nov 9, 2021):

  1. use any input that accepts markdown

Please specify exactly what you're doing.

@jeremystretch commented on GitHub (Nov 9, 2021): > 2. use any input that accepts markdown Please specify _exactly_ what you're doing.
adam commented 2025-12-29 19:30:26 +01:00
Author
Owner
Copy Link

@SoufElhabti commented on GitHub (Nov 9, 2021):

when for example a adding a site in /dcim/sites/ in the comment section submit the payload

 [37qpypz37qpypz37qpypz37qpypz37qpypz]  
37qpypz37qpypz37qpypz37qpypz37qpypz]: javascript:alert(1)

if this wasn't helpful please refer to the video i recorded for the POC
POC VIdeo

@SoufElhabti commented on GitHub (Nov 9, 2021): when for example a adding a site in `/dcim/sites/` in the comment section submit the payload ``` [37qpypz37qpypz37qpypz37qpypz37qpypz] 37qpypz37qpypz37qpypz37qpypz37qpypz]: javascript:alert(1) ``` if this wasn't helpful please refer to the video i recorded for the POC [POC VIdeo](https://drive.google.com/file/d/14xANXPj07IuAQ15qgO-UK48s7bgoemmz/view?usp=sharing)
adam commented 2025-12-29 19:30:27 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Nov 9, 2021):

I'm not able to reproduce this on NetBox v3.0.9. I just see the plain string as entered. It's possible this may be unique to the docker image, in which case you'll need to open a separate bug against that project. What version of Markdown do you have installed?

Screenshot_2021-11-09 Foo NetBox

@jeremystretch commented on GitHub (Nov 9, 2021): I'm not able to reproduce this on NetBox v3.0.9. I just see the plain string as entered. It's possible this may be unique to the docker image, in which case you'll need to open a separate bug against that project. What version of Markdown do you have installed? ![Screenshot_2021-11-09 Foo NetBox](https://user-images.githubusercontent.com/13487278/140995618-fd62c566-e8b4-4cf7-a47d-b83a2c72b195.png)
adam commented 2025-12-29 19:30:29 +01:00
Author
Owner
Copy Link

@SoufElhabti commented on GitHub (Nov 9, 2021):

sorry for giving you hard time reproducing it. It is :

 [37qpypz37qpypz37qpypz37qpypz37qpypz]  
[37qpypz37qpypz37qpypz37qpypz37qpypz]: javascript:alert(1)

i forgot a [

@SoufElhabti commented on GitHub (Nov 9, 2021): sorry for giving you hard time reproducing it. It is : ``` [37qpypz37qpypz37qpypz37qpypz37qpypz] [37qpypz37qpypz37qpypz37qpypz37qpypz]: javascript:alert(1) ``` i forgot a `[`
adam commented 2025-12-29 19:30:31 +01:00
Author
Owner
Copy Link

@kkthxbye-code commented on GitHub (Nov 9, 2021):

Duplicate of #4717 - the recommended solution for python-markdown is to filter the html with bleach. Another solution could be to swap it out for another parser that enforces rules for links. Third option would be to try to patch the regex filter in render_markdown.

You don't have to do all that weird stuff he's doing in the payload though, a simple example like this should work:

[test
test](javascript:alert(0))
@kkthxbye-code commented on GitHub (Nov 9, 2021): Duplicate of #4717 - the recommended solution for python-markdown is to filter the html with bleach. Another solution could be to swap it out for another parser that enforces rules for links. Third option would be to try to patch the regex filter in render_markdown. You don't have to do all that weird stuff he's doing in the payload though, a simple example like this should work: ``` [test test](javascript:alert(0)) ```
adam commented 2025-12-29 19:30:33 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Nov 9, 2021):

That does not work, at least under a normally configured instance

@DanSheps commented on GitHub (Nov 9, 2021): That does not work, at least under a normally configured instance
adam commented 2025-12-29 19:30:33 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Nov 9, 2021):

Found the hole...

So, you need to use a reference style link:

# Does not work
[Test](javascript:alert(1))


# Does work
[Test 2][ref]

[ref]: javascript:alert(1)
@DanSheps commented on GitHub (Nov 9, 2021): Found the hole... So, you need to use a reference style link: ``` # Does not work [Test](javascript:alert(1)) # Does work [Test 2][ref] [ref]: javascript:alert(1) ```
adam commented 2025-12-29 19:30:34 +01:00
Author
Owner
Copy Link

@kkthxbye-code commented on GitHub (Nov 9, 2021):

You are misunderstanding the one I posted. You need the newline to bypass the regex.

I verified on both docker and local versions, also you can see it here on the demo instance.

https://demo.netbox.dev/dcim/devices/17/

Again, it's all mentioned in the duplicate issue I linked. The reference style version is new though I guess, but not really the main issue.

@kkthxbye-code commented on GitHub (Nov 9, 2021): You are misunderstanding the one I posted. You need the newline to bypass the regex. I verified on both docker and local versions, also you can see it here on the demo instance. https://demo.netbox.dev/dcim/devices/17/ Again, it's all mentioned in the duplicate issue I linked. The reference style version is new though I guess, but not really the main issue.
adam commented 2025-12-29 19:30:34 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Nov 9, 2021):

Yes, but if you look at the reference style, that is exactly the style that he is using (he just omited the actual link and only included the reference)

So it looks like both methods do bypass the allowed URL schemes.

@DanSheps commented on GitHub (Nov 9, 2021): Yes, but if you look at the reference style, that is exactly the style that he is using (he just omited the actual link and only included the reference) So it looks like both methods do bypass the allowed URL schemes.
adam commented 2025-12-29 19:30:34 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Nov 9, 2021):

Summary:

ALLOWED_URLS_SCHEMES check is bypassed on either of the following conditions:

  1. Multi-line links
  2. Reference style links

The question is, do we want to sink time into this. To quote from the previous issue which quotes from the bleach docs:

Bleach is powerful but it is not fast. If you trust your users, trust them and don’t rely on Bleach to clean up their mess.

As NetBox is not a end-user facing application, do we want to worry about this too much?

@DanSheps commented on GitHub (Nov 9, 2021): Summary: ALLOWED_URLS_SCHEMES check is bypassed on either of the following conditions: 1. Multi-line links 2. Reference style links The question is, do we want to sink time into this. To quote from the previous issue which quotes from the bleach docs: > Bleach is powerful but it is not fast. If you trust your users, trust them and don’t rely on Bleach to clean up their mess. As NetBox is not a end-user facing application, do we want to worry about this too much?
adam commented 2025-12-29 19:30:34 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Nov 9, 2021):

A few thoughts:

  1. If we were to invoke something "heavy" like Bleach, we would need to first transition to pre-rendered HTML for all objects to mitigate the performance penalty. This would be a major change representing significant effort.
  2. There may be valid use cases for javascript: links, particularly where plugins are in use.
  3. Even using Bleach doesn't guarantee complete protection against XSS. The only surefire approach would be to strip all HTML tags, which is obviously undesirable.
@jeremystretch commented on GitHub (Nov 9, 2021): A few thoughts: 1. If we were to invoke something "heavy" like Bleach, we would need to first transition to pre-rendered HTML for all objects to mitigate the performance penalty. This would be a major change representing significant effort. 2. There may be valid use cases for `javascript:` links, particularly where plugins are in use. 3. Even using Bleach doesn't guarantee complete protection against XSS. The only surefire approach would be to strip _all_ HTML tags, which is obviously undesirable.
adam commented 2025-12-29 19:30:35 +01:00
Author
Owner
Copy Link

@SoufElhabti commented on GitHub (Nov 9, 2021):

i suggest something such as navigate-to which will prevent opening stuff like javascript:

@SoufElhabti commented on GitHub (Nov 9, 2021): i suggest something such as [navigate-to](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/navigate-to) which will prevent opening stuff like ``javascript:``
adam commented 2025-12-29 19:30:35 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Nov 10, 2021):

i suggest something such as navigate-to which will prevent opening stuff like javascript:

My understanding is no browser supports that tag.

Additionally, as stretch mentioned, there may be instances where javascript: links are desired.

@DanSheps commented on GitHub (Nov 10, 2021): > i suggest something such as [navigate-to](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/navigate-to) which will prevent opening stuff like `javascript:` My understanding is no browser supports that tag. Additionally, as stretch mentioned, there may be instances where javascript: links are desired.
adam commented 2025-12-29 19:30:35 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Nov 11, 2021):

I've modified and extended the regular expressions to match both examples above (the multi-line link and the reference link). I believe this addresses the concern raised by the bug report.

@jeremystretch commented on GitHub (Nov 11, 2021): I've modified and extended the regular expressions to match both examples above (the multi-line link and the reference link). I believe this addresses the concern raised by the bug report.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5639
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?