CVE-2024-36112

Executive Summary

CVE-2024-36112 is a missing authorization vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. The flaw allows users with the extras.view_dynamicgroup permission to enumerate members of Dynamic Groups via the UI or REST API, bypassing object-level permissions (e.g., dcim.view_device). This leads to unauthorized information disclosure of sensitive network device data. The vulnerability affects versions 1.3.0 through 1.6.22 and 2.0.0 through 2.2.4. Patches are available in versions 1.6.23 and 2.2.5. The EPSS score is 0.0%, indicating low exploitation likelihood, but the risk is elevated in multi-tenant environments.

Supply Chain & Package Security

Nautobot is a Python-based application distributed via PyPI. Organizations using pip or Docker images should verify their installed version and update to the patched releases. No malicious packages have been reported in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (requires extras.view_dynamicgroup permission)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (disclosure of Dynamic Group members)
• Integrity Impact: Low (potential modification if combined with other flaws)
• Availability Impact: Low (no direct DoS, but data exposure may lead to further attacks)

Threat Level: Medium. The vulnerability requires authenticated access with a specific permission, but it can expose sensitive network inventory data.

Deep Dive & Mechanics

The Dynamic Groups feature in Nautobot allows administrators to define groups of objects (e.g., Devices, IP Addresses) based on filter criteria. The vulnerability lies in the authorization check when listing group members. The code fails to verify that the requesting user has the necessary object-level permissions (e.g., dcim.view_device) for each member object. Instead, it only checks the extras.view_dynamicgroup permission, which is insufficient.

Root Cause: In the view logic for /extras/dynamic-groups/<uuid>/ and the REST API endpoint /api/extras/dynamic-groups/<uuid>/members/, the system retrieves all members of the group without filtering based on the user's permissions. This is a classic case of missing authorization (CWE-862).

Attack Scenario:

1. An attacker with extras.view_dynamicgroup permission (e.g., a junior network operator) accesses the Dynamic Group detail page.
2. The attacker views the list of members, which may include devices they are not authorized to see.
3. The attacker can then use this information to target specific devices or network segments.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Patch):

# In views/dynamic_groups.py
class DynamicGroupMembersView(PermissionRequiredMixin, View):
    permission_required = "extras.view_dynamicgroup"
    
    def get(self, request, pk):
        group = get_object_or_404(DynamicGroup, pk=pk)
        members = group.members.all()  # No permission filtering
        return render(request, "extras/dynamicgroup_members.html", {"members": members})

Patched Code (Post-Patch):

# In views/dynamic_groups.py
from nautobot.core.views.mixins import ObjectPermissionRequiredMixin

class DynamicGroupMembersView(ObjectPermissionRequiredMixin, View):
    permission_required = "extras.view_dynamicgroup"
    
    def get(self, request, pk):
        group = get_object_or_404(DynamicGroup, pk=pk)
        # Apply object-level permissions
        members = group.members.restrict(request.user, "view")
        return render(request, "extras/dynamicgroup_members.html", {"members": members})

The patch adds a call to .restrict(request.user, "view") which filters the queryset based on the user's permissions for each object type.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Nautobot instance (version 1.3.0-1.6.22 or 2.0.0-2.2.4)
• A user account with extras.view_dynamicgroup permission

Steps:

1. Authenticate to the Nautobot web UI or API.
2. Identify a Dynamic Group UUID (e.g., via /api/extras/dynamic-groups/).
3. Access the members list:
   • UI: Navigate to /extras/dynamic-groups/<uuid>/
   • API: Send GET request to /api/extras/dynamic-groups/<uuid>/members/
4. Observe that all members are returned, regardless of object-level permissions.

Example API Request:

curl -X GET "https://nautobot.example.com/api/extras/dynamic-groups/abc123/members/" \
  -H "Authorization: Token YOUR_API_TOKEN"

Expected Output:

{
    "count": 5,
    "results": [
        {"id": 1, "name": "router-01", "device_type": "Cisco 4321"},
        {"id": 2, "name": "switch-02", "device_type": "Juniper EX2300"},
        ...
    ]
}

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for repeated access to /api/extras/dynamic-groups/*/members/ by users with low privileges.
• Alert on unusual patterns of Dynamic Group enumeration.

Hardening:

• Remove extras.view_dynamicgroup permission from users who do not require it.
• Apply network segmentation to limit access to the Nautobot API.
• Enable audit logging for all API requests.

Indicators of Compromise (IOCs)

• Log Entries: Repeated GET requests to /api/extras/dynamic-groups/<uuid>/members/ from a single user within a short time frame.
• Network Traffic: Unusual API calls to Nautobot endpoints related to Dynamic Groups.
• User Behavior: A user with extras.view_dynamicgroup but no dcim.view_device permission accessing device lists.

Detection Engineering

YARA Rule

rule Detect_Nautobot_DynamicGroup_Enumeration {
    meta:
        description = "Detects attempts to enumerate Dynamic Group members in Nautobot"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36112"
    strings:
        $api_path = "/api/extras/dynamic-groups/"
        $members_path = "/members/"
        $ui_path = "/extras/dynamic-groups/"
    condition:
        any of ($api_path, $ui_path) and $members_path
}

Sigma Rule

title: Nautobot Dynamic Group Member Enumeration
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized enumeration of Dynamic Group members in Nautobot
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36112
logsource:
    category: web
    product: nautobot
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: 
            - '/api/extras/dynamic-groups/'
            - '/extras/dynamic-groups/'
        cs-uri-stem|endswith: '/members/'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36112 Nautobot Dynamic Group Member Enumeration";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/api/extras/dynamic-groups/";
    http_uri;
    content:"/members/";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nautobot to version 1.6.23 or 2.2.5 (or later).
2. If upgrade is not possible, remove extras.view_dynamicgroup permission from all non-admin users as a partial mitigation.

Long-term Measures:

• Implement principle of least privilege for all Nautobot permissions.
• Regularly audit user permissions and access logs.
• Enable object-level permissions for all sensitive data types.

Patch Details:

• Version 1.6.23: GitHub Release
• Version 2.2.5: GitHub Release

Valters IT