CVE-2024-29199

Executive Summary

CVE-2024-29199 is a medium-severity vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. The flaw allows unauthenticated (anonymous) users to access certain URL endpoints that should require authentication. While these endpoints do not expose sensitive data by default, they become exploitable if the EXEMPT_VIEW_PERMISSIONS configuration variable is modified from its default empty list. The vulnerability has a CVSS score of 3.7, indicating low severity, but it could lead to information disclosure in misconfigured environments. The EPSS score is 0.0%, suggesting low exploitation likelihood. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Nautobot is a Python-based package distributed via PyPI. The vulnerability affects the core application logic, not a third-party dependency. Users should ensure they are using the latest patched versions (1.6.16 or 2.1.9) from the official PyPI repository. Verify package integrity via checksums provided in the GitHub release.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 3.7 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – Requires specific configuration changes to be exploitable.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires non-default configuration and no public exploits exist.

Deep Dive & Mechanics

The vulnerability stems from improper access control checks in several Nautobot URL endpoints. By default, Nautobot denies all unauthenticated access. However, the EXEMPT_VIEW_PERMISSIONS setting allows administrators to whitelist specific views for anonymous users. The flaw occurs when this setting is misconfigured or when endpoints are inadvertently left unprotected.

Root Cause: The nautobot.core.views module does not enforce authentication on certain endpoints unless explicitly configured. The EXEMPT_VIEW_PERMISSIONS list is checked, but if empty, all endpoints should be protected. However, due to a logic error, some endpoints bypass this check.

Affected Endpoints: Examples include:

• /api/status/
• /api/version/
• /api/docs/ (if enabled)

These endpoints may reveal system metadata (e.g., version numbers, API schema) to unauthenticated users.

Attack Scenario: An attacker scans for Nautobot instances with EXEMPT_VIEW_PERMISSIONS set to allow access to specific views. They then query the unprotected endpoints to gather information for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.6.16 / pre-2.1.9):

# nautobot/core/views.py
def get_view_permissions(view):
    exempt = settings.EXEMPT_VIEW_PERMISSIONS
    if exempt and view in exempt:
        return True
    # Missing authentication check for non-exempt views
    return False

Patched Code (1.6.16 / 2.1.9):

# nautobot/core/views.py
def get_view_permissions(view):
    exempt = settings.EXEMPT_VIEW_PERMISSIONS
    if exempt and view in exempt:
        return True
    # Added explicit authentication requirement
    if not request.user.is_authenticated:
        return False
    return True

The patch ensures that all endpoints require authentication unless explicitly exempted.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Nautobot instance with EXEMPT_VIEW_PERMISSIONS set to allow access to specific endpoints (e.g., ["api/status/"]).
• Network access to the target.

Exploitation Steps:

1. Identify Nautobot instances using Shodan dorks or manual scanning.
2. Test for unprotected endpoints:

   curl -v http://target/nautobot/api/status/
   

3. If the endpoint returns data without authentication, the instance is vulnerable.
4. Enumerate other endpoints:

   curl -v http://target/nautobot/api/version/
   curl -v http://target/nautobot/api/docs/
   

Expected Output: JSON response with system information (e.g., version, API schema).

Blue Team

Detection:

• Monitor for unauthenticated requests to /api/status/, /api/version/, or /api/docs/.
• Alert on HTTP 200 responses to these endpoints without prior authentication.

Hunting:

• Review Nautobot logs for anonymous access to API endpoints.
• Check EXEMPT_VIEW_PERMISSIONS configuration for unexpected entries.

Lab Setup:

1. Deploy a vulnerable Nautobot instance (version < 1.6.16 or < 2.1.9).
2. Set EXEMPT_VIEW_PERMISSIONS = ["api/status/"] in nautobot_config.py.
3. Restart the service and test exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unauthenticated HTTP requests to /api/status/, /api/version/, /api/docs/.
  • Source IPs not in trusted ranges accessing these endpoints.
• Log IOCs:
  • Nautobot access logs showing GET /api/status/ with status 200 and no Authorization header.
  • Repeated attempts to enumerate API endpoints from the same IP.
• File IOCs:
  • Modified nautobot_config.py with non-empty EXEMPT_VIEW_PERMISSIONS list.

Detection Engineering

YARA Rule

rule CVE_2024_29199_Nautobot_Anonymous_Access {
    meta:
        description = "Detects Nautobot configuration files with EXEMPT_VIEW_PERMISSIONS set"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-29199"
    strings:
        $config = "EXEMPT_VIEW_PERMISSIONS"
        $non_empty = /EXEMPT_VIEW_PERMISSIONS\s*=\s*\[[^\]]*[^\s\]]/
    condition:
        $config and $non_empty
}

Sigma Rule

title: Nautobot Anonymous API Access
id: 8f4b3c2a-1d5e-4f7b-9a0c-3e6d8f2b1a4c
status: experimental
description: Detects unauthenticated access to Nautobot API endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nautobot
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/api/status/'
            - '/api/version/'
            - '/api/docs/'
        sc-status: 200
    filter:
        cs-auth-type: 'Basic'  # or 'Bearer' depending on config
    condition: selection and not filter
falsepositives:
    - Legitimate anonymous access if EXEMPT_VIEW_PERMISSIONS is intentionally set
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29199 Nautobot Anonymous API Access"; flow:to_server; content:"GET"; http_method; content:"/api/status/"; http_uri; nocase; content:"/api/version/"; http_uri; nocase; content:"/api/docs/"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nautobot to version 1.6.16 or 2.1.9 (or later).
2. Review and reset EXEMPT_VIEW_PERMISSIONS to an empty list [] if not required.
3. Restrict network access to Nautobot instances using firewalls or VPNs.

Long-term Measures:

• Implement regular security audits of configuration files.
• Enable logging and monitoring for anonymous access attempts.
• Use a Web Application Firewall (WAF) to block unauthenticated requests to sensitive endpoints.

Workaround: If patching is not immediately possible, set EXEMPT_VIEW_PERMISSIONS = [] and restart the service.

Valters IT
Securing Networks, One CVE at a Time.