starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Possible Vulnerabilities #947

New Issue
Closed
opened 2025-12-29 16:27:10 +01:00 by adam · 2 comments
adam commented 2025-12-29 16:27:10 +01:00
Owner
Copy Link

Originally created by @arraisfilho on GitHub (May 13, 2017).

Issue type:

I checked some files used in the netbox, some of them have CWE known, below the list and files.

This alert may be a false positive, manual confirmation is required.

/static/jquery-ui-1.12.1
https://cwe.mitre.org/data/definitions/352.html

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts.

/static/jquery-ui-1.12.1/package.json
https://cwe.mitre.org/data/definitions/538.html

A configuration file (e.g. Vagrantfile, Gemfile, Rakefile, ...) was found in this directory. This file may expose sensitive information that could help a malicious user to prepare more advanced attacks. It's recommended to remove or restrict access to this type of files from production systems.

Python version: 2.7.12+
NetBox version: 2.0.1

Originally created by @arraisfilho on GitHub (May 13, 2017). <!-- Please note: GitHub issues are to be used only for feature requests and bug reports. For installation assistance or general discussion, please join us on the mailing list: https://groups.google.com/forum/#!forum/netbox-discuss Please indicate "bug report" or "feature request" below. Be sure to search the existing set of issues (both open and closed) to see if a similar issue has already been raised. --> ### Issue type: I checked some files used in the netbox, some of them have CWE known, below the list and files. This alert may be a false positive, manual confirmation is required. **/static/jquery-ui-1.12.1** *https://cwe.mitre.org/data/definitions/352.html* Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. **/static/jquery-ui-1.12.1/package.json** *https://cwe.mitre.org/data/definitions/538.html* A configuration file (e.g. Vagrantfile, Gemfile, Rakefile, ...) was found in this directory. This file may expose sensitive information that could help a malicious user to prepare more advanced attacks. It's recommended to remove or restrict access to this type of files from production systems. <!-- If filing a bug, please indicate the version of Python and NetBox you are running. (This is not necessary for feature requests.) --> Python version: **2.7.12+** NetBox version: **2.0.1** <!-- If filing a bug, please record the exact steps taken to reproduce the bug and any errors messages that are generated. If filing a feature request, please precisely describe the data model or workflow you would like to see implemented, and provide a use case. -->
adam closed this issue 2025-12-29 16:27:10 +01:00
adam commented 2025-12-29 16:27:10 +01:00
Author
Owner
Copy Link

@hydratim commented on GitHub (May 14, 2017):

This might be true, however netbox is clearly not intended to be used in a public / client facing environment and has no significant user structure (other than authorised or unauthorised and the secret management platform where signed key = full access), as such it is clear that security within this project is not a significant designed intent.
However I'm sure that if someone where to put up a pull request that fixed the issues you point out that it would indeed be accepted.

@hydratim commented on GitHub (May 14, 2017): This might be true, however netbox is clearly not intended to be used in a public / client facing environment and has no significant user structure (other than authorised or unauthorised and the secret management platform where signed key = full access), as such it is clear that security within this project is not a significant designed intent. However I'm sure that if someone where to put up a pull request that fixed the issues you point out that it would indeed be accepted.
adam commented 2025-12-29 16:27:11 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (May 15, 2017):

It looks like you ran an analysis tool against the code base and pasted the results into a ticket. Both of the files mentioned are part of the standard jQuery UI library. As no specific course of action has been proposed here, I'm closing out this ticket.

@jeremystretch commented on GitHub (May 15, 2017): It looks like you ran an analysis tool against the code base and pasted the results into a ticket. Both of the files mentioned are part of the standard [jQuery UI](https://jqueryui.com/) library. As no specific course of action has been proposed here, I'm closing out this ticket.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#947
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?