CVE-2023-46128

Executive Summary

CVE-2023-46128 is an information disclosure vulnerability in Nautobot 2.0.x, a Network Automation Platform built on the Django Python framework. Certain REST API endpoints, when queried with the ?depth=<N> query parameter, expose hashed user passwords from the database to any authenticated user with access to those endpoints. The vulnerability is patched in Nautobot version 2.0.3. While passwords are not disclosed in plaintext, the exposure of password hashes allows offline brute-force and dictionary attacks that can lead to account compromise.

Technical Analysis

Nautobot is a network automation platform implemented as a web application on top of the Django Python framework, using PostgreSQL or MySQL as the backend database. Django's Object-Relational Mapper (ORM) provides developers with a convenient mechanism to serialize model objects into JSON representations, commonly via Django REST Framework (DRF).

The vulnerability exists in Nautobot 2.0.x in the interaction between certain REST API endpoints and the ?depth=<N> query parameter. The depth parameter is used to control serialization depth — that is, how many levels of nested related objects are included in the API response. In affected versions, when the depth parameter is set to specific values, the serialization logic traverses related model references in a way that the default serializer configuration fails to restrict, exposing fields that are not intended for API output.

Specifically, the password field of user objects — stored as a salted hash in the Django user model (e.g., via django.contrib.auth.models.User) — is exposed in the API response. Under normal conditions, the default Django REST Framework serializer should exclude the password field (it is write-only in default configurations). However, the depth-traversal mechanism in Nautobot 2.0.x bypasses this write-only designation, causing the password hash field to be included in the serialized JSON output.

The attack surface is limited to authenticated users who have access to REST API endpoints. No privilege escalation is required to trigger the vulnerability — any user with valid credentials and API access can exploit the flaw. The exposure is limited to the stored password hash (e.g., PBKDF2, Argon2, or bcrypt format as configured by Django), not the plaintext password.

The root cause is a misconfiguration in serializer depth handling. When nested object serialization exceeds a certain depth, Django REST Framework's default behavior of deferring to explicitly declared fields is overridden, and the dynamically generated serializer includes all model fields, including those marked as write-only or excluded from output. This is an instance of improper access control in serialization logic (CWE-522: Insufficiently Protected Credentials).

Exploitation Scenarios

No public PoC is available at the time of writing; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker identifies Nautobot instances by fingerprinting the web application (HTTP headers, login page signatures, or by querying network space). Confirmation of a vulnerable version (2.0.0–2.0.2) may be achieved by checking the application version exposed via the API root endpoint or the admin login page, or by simply attempting the exploitation technique against the target.

Step 2 — Triggering the Flaw: The attacker authenticates to the target Nautobot instance using any valid user account (low-privilege accounts suffice). Using the REST API, the attacker queries an affected endpoint that returns user objects (e.g., the users or accounts endpoint as exposed by Nautobot's API), appending the query parameter ?depth=<N> where N is a value that triggers nested serialization of the user password field. The exact value of N is determined by the serializer depth configuration; experimentation with values N=1 through N=3 is typically sufficient to trigger the flaw.

Step 3 — Payload / Execution Method: Because this is an information disclosure vulnerability rather than code execution, there is no payload in the traditional sense. The attack involves constructing a crafted HTTP GET request to the vulnerable API endpoint. For example:

GET /api/users/?depth=1

or similar endpoints that return user model data. The response JSON will contain user objects including the password field populated with the stored hash (e.g., pbkdf2_sha256$...).

Step 4 — Post-Exploitation Impact: The attacker extracts the hashed passwords from the response. These hashes can then be subjected to offline brute-force or dictionary attacks (e.g., using hashcat or John the Ripper). If any user has a weak password, the attacker can recover the plaintext value and then authenticate to Nautobot as that user. Compromised accounts may include administrators, allowing further lateral movement, configuration changes, or access to sensitive network automation data. The attacker may also harvest additional user data exposed by the same endpoint, including email addresses and account metadata.

Impact Assessment

Confidentiality Impact (HIGH): The vulnerability directly exposes password hashes. Regardless of the hashing algorithm used, these hashes are sensitive and substantially increase the risk of credential compromise through offline attacks.

Integrity Impact (NONE): No write access is granted by this vulnerability.

Availability Impact (NONE): The vulnerability does not impact system or service availability.

CVSS Score: 6.5 (Medium) — reflecting the requirement for authentication and the non-plaintext exposure, but with HIGH confidentiality impact.

Business Impact: Nautobot is used as a source of truth for network infrastructure. Compromised credentials could lead to unauthorized changes to network configuration, denial of service (by misconfiguration), data theft, or pivot into the broader network environment. Organizations running Nautobot 2.0.x should treat this as high priority for patching, especially if user accounts use weak or reused passwords.

Blast Radius: Any Nautobot 2.0.0–2.0.2 instance; the exposure extends to all users stored in the database. Instances with many service accounts or shared credentials have a larger blast radius.

Detection Guidance

Sigma Rule

title: Nautobot REST API Password Hash Disclosure via Depth Parameter
id: 8f7c3a42-9e1d-4f0b-8c35-2d61b5f8a7e1
status: experimental
description: Detects attempts to exploit CVE-2023-46128 by querying Nautobot REST API endpoints with the depth parameter to disclose password hashes.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46128
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: webserver
    product: nginx
    definition: 'Nautobot REST API traffic'
detection:
    selection_method:
        cs-method: GET
    selection_path:
        cs-uri-query|contains: 'depth='
    selection_status:
        sc-status: 200
    filter_excluded_paths:
        cs-uri-query|contains:
            - 'depth=0'
            - 'depth=10'
    condition: selection_method and selection_path and selection_status and not filter_excluded_paths
    timeframe: 5m
level: high
falsepositives:
    - Legitimate API use by administrators or automation scripts using depth parameter for nested object retrieval
    - Depth parameter may be used legitimately in many Nautobot API queries
fields:
    - clientip
    - cs-uri-query
    - sc-status
tags:
    - attack.t1213
    - cve.2023.46128

YARA Rule

rule Nautobot_Password_Hash_Disclosure_REST_Response
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP responses from Nautobot that contain password hash fields exposed via depth parameter traversal"
        cve = "CVE-2023-46128"
        date = "2024-01-15"
        score = 60

    strings:
        // Django password hash prefix patterns
        $pbkdf2 = /"password"\s*:\s*"pbkdf2_sha256\$/ 
        $argon2 = /"password"\s*:\s*"argon2\$/ 
        $bcrypt = /"password"\s*:\s*"bcrypt\$/ 
        $sha1   = /"password"\s*:\s*"sha1\$/ 

        // Depth parameter indicators in request (may appear in logs)
        $depth_param = "depth="

    condition:
        any of ($pbkdf2, $argon2, $bcrypt, $sha1) and $depth_param
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Nautobot CVE-2023-46128 Password Hash Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"depth="; http_uri; reference:cve,2023-46128; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "network_traffic" and
    network.protocol == "http" and
    http.request.method == "GET" and
    url.query contains "depth=" ]
  [ network where event.category == "network_traffic" and
    network.protocol == "http" and
    http.response.status_code == 200 and
    http.response.body contains "pbkdf2_sha256$" or
    http.response.body contains "argon2$" ]

Splunk SPL Query

index=proxy OR index=web
| where match(cs_uri_query, "depth=\\d+")
| search sc_status=200
| rex field=_raw "password\\\\?\\\"\\\\?:\\\\?\\\"([^\\\\?\\\"]+)"
| where match(password, "^(pbkdf2_sha256|argon2|bcrypt|sha1)\\$")
| stats count by src_ip uri_path cs_uri_query password
| sort - count

Wazuh OSSEC Rule

<group name="nginx,web,nautobot,">
    <rule id="100018" level="12">
        <decoded_as>json</decoded_as>
        <match>depth=</match>
        <match>GET</match>
        <field name="response">200</field>
        <description>Nautobot CVE-2023-46128: Suspicious REST API request with depth parameter - possible password hash disclosure</description>
        <group>cve-2023-46128,</group>
        <mitre>
            <id>T1213</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY) — Two independent sources (CNA and OSV) confirm the fix.

1. Immediate Mitigations

   • Restrict access to Nautobot REST API endpoints to only trusted users and network ranges.
   • Temporarily disable anonymous and low-trust API credentials until patching.
   • Monitor API logs for abnormal usage of the depth parameter.

2. Patch/Upgrade Steps

   • Upgrade Nautobot to version 2.0.3 immediately.
   • Verify after upgrade that User REST API endpoints no longer return the password field in responses.
   • After upgrading, force all users to change their passwords since hashes may have been exposed.

3. Long-Term Hardening

   • Ensure Nautobot is patched to the latest available version (check vendor advisories regularly).
   • Implement multi-factor authentication (MFA) for all user accounts to reduce risk if password hashes are leaked.
   • Enforce strong password policies and use a password manager to minimize offline brute-force risk.
   • Audit API access logs regularly for unusual patterns, especially for depth parameter usage.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-46128
2. Nautobot Official Site (vendor): https://www.nautobot.com/
3. OSV Database Entry: https://osv.dev/vulnerability/CVE-2023-46128
4. Nautobot GitHub Repository (patch references): https://github.com/nautobot/nautobot

Threat Actor Activity / Exploit-in-the-Wild: No known threat actor campaigns have been associated with this CVE. No CISA KEV listing, no public exploit code, and no nuclei template have been identified as of the writing of this report.