CVE-2025-49143

Executive Summary

CVE-2025-49143 is a missing authentication vulnerability in Nautobot, a Network Source of Truth and Network Automation Platform. Prior to versions v2.4.10 and v1.6.32, files uploaded by users to Nautobot's MEDIA_ROOT directory—including DeviceType image attachments as well as images attached to a Location, Device, or Rack—are served to users via a URL endpoint that does not enforce user authentication. This allows anonymous users who know or can guess the correct URL for a given file to retrieve those files. The vulnerability has a CVSS score of 0.0 (likely uncalculated or placeholder), but based on the description, it is a medium-severity information disclosure issue. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code is available. The patch is available in Nautobot v2.4.10 and v1.6.32, which add authentication enforcement to the media file serving endpoint.

Supply Chain & Package Security

Nautobot is a Python-based application distributed via PyPI. This vulnerability does not directly affect the supply chain, but users should ensure they are using official packages from PyPI and verify package signatures if available. The patch is a server-side fix and does not require changes to dependencies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to know or guess the file URL.
• Privileges Required (PR): None (N) – No authentication is required to exploit.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Only specific media files are exposed, not the entire system.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 5.3 (Medium) – Information disclosure of potentially sensitive media files.

Threat Level: Medium. The vulnerability allows unauthenticated access to uploaded media files, which may include network topology images, device photos, or other sensitive data. However, exploitation requires knowledge of the file URL, which may be difficult to guess unless the file name is predictable.

Deep Dive & Mechanics

The vulnerability exists in the URL endpoint that serves files from Nautobot's MEDIA_ROOT directory. In affected versions, this endpoint does not check whether the requesting user is authenticated. The endpoint is typically mapped to a URL pattern like /media/<path:file_path>. When a user uploads a file (e.g., a DeviceType image), the file is stored in MEDIA_ROOT and can be accessed via a URL like https://nautobot.example.com/media/devicetype-images/switch.png. An unauthenticated attacker who can guess or enumerate the file path can retrieve the file.

The root cause is a missing authentication check in the view or middleware that handles static/media file serving. In Django (the framework Nautobot is built on), static and media files are often served by the web server (e.g., Nginx) or by Django's django.views.static.serve view. The vulnerability likely stems from the latter being used without proper authentication decorators.

The patch in v2.4.10 and v1.6.32 adds authentication enforcement to this endpoint, likely by wrapping the view with @login_required or by checking request.user.is_authenticated before serving the file.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-patch):

# In urls.py or views.py (simplified)
from django.conf import settings
from django.conf.urls.static import static

urlpatterns = [
    # ... other URLs
] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)

This uses Django's built-in static file serving without authentication.

Patched Code (Post-patch):

# In views.py
from django.contrib.auth.decorators import login_required
from django.http import FileResponse
from django.shortcuts import get_object_or_404
import os

@login_required
def serve_media(request, path):
    file_path = os.path.join(settings.MEDIA_ROOT, path)
    if not os.path.exists(file_path):
        raise Http404
    return FileResponse(open(file_path, 'rb'))

The patched version wraps the file serving logic with @login_required, ensuring only authenticated users can access media files.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Nautobot instance (v2.4.9 or earlier, or v1.6.31 or earlier).
• Knowledge of a valid media file URL (e.g., from a previous authenticated session or by guessing).

Exploitation Steps:

1. Identify the Nautobot instance URL (e.g., https://nautobot.example.com).
2. Guess or enumerate media file paths. Common patterns include:
   • /media/devicetype-images/<filename>
   • /media/location-images/<filename>
   • /media/device-images/<filename>
   • /media/rack-images/<filename>
3. Use a tool like curl or a web browser to access the URL without authentication:

   curl -v http://nautobot.example.com/media/devicetype-images/switch.png
   

4. If the file exists, it will be returned without any authentication challenge.

Example Output:

HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 12345

[Binary image data]

Blue Team

Detection:

• Monitor web server logs for requests to /media/ paths from unauthenticated IPs.
• Look for patterns of sequential or brute-force file name guessing (e.g., file1.png, file2.png).
• Use the Sigma rule provided in the Detection Engineering section.

Hunting:

• Search for any 200 OK responses to /media/ paths from IPs not associated with authenticated sessions.
• Check for unusual file types being accessed (e.g., .png, .jpg, .svg).

Lab Setup:

1. Deploy a vulnerable Nautobot instance using Docker:

   docker run -d -p 8080:80 nautobot/nautobot:2.4.9
   

2. Upload a test image via the web interface (requires authentication).
3. Access the image URL without authentication to confirm the vulnerability.
4. Upgrade to v2.4.10 and verify the fix.

Indicators of Compromise (IOCs)

• URL Patterns: Requests to /media/ paths without a preceding authentication cookie or token.
• HTTP Status Codes: 200 OK for /media/ requests from unauthenticated sources.
• File Types: Image files (.png, .jpg, .gif, .svg) served to anonymous users.
• Log Entries: Web server logs showing GET /media/... with no Authorization header or session cookie.
• Network Traffic: Unencrypted HTTP requests to media endpoints (if HTTPS is not enforced).

Detection Engineering

YARA Rule

rule CVE_2025_49143_Media_Access {
    meta:
        description = "Detects unauthenticated access to Nautobot media files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49143"
    strings:
        $media_path = "/media/" nocase
        $nautobot_cookie = "sessionid" nocase
    condition:
        $media_path and not $nautobot_cookie
}

Sigma Rule

title: Unauthenticated Access to Nautobot Media Files
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Nautobot media endpoints without authentication
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49143
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/media/'
    filter:
        cs-uri-stem|contains: 'static'  # Exclude static files if served separately
    condition: selection and not filter
falsepositives:
    - Legitimate unauthenticated access to public media files (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49143 - Unauthenticated Nautobot Media Access"; flow:to_server; http.method; content:"GET"; http.uri; content:"/media/"; startswith; http.cookie; content:!"sessionid"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nautobot to v2.4.10 or v1.6.32 (or later) as soon as possible.
2. If immediate upgrade is not possible, implement a reverse proxy rule to block unauthenticated access to /media/ paths. For example, in Nginx:

   location /media/ {
       # Require authentication via a custom header or cookie
       if ($http_cookie !~* "sessionid") {
           return 403;
       }
       proxy_pass http://nautobot_backend;
   }
   

3. Review and rotate any sensitive media files that may have been exposed.

Long-term Mitigations:

• Ensure all file serving endpoints enforce authentication.
• Use a dedicated media server (e.g., S3 with signed URLs) instead of serving files directly from the application.
• Implement file name randomization to prevent guessing.
• Enable HTTPS to protect media files in transit.

Patch Details:

• Upgrade to Nautobot v2.4.10 or v1.6.32.
• The patch adds authentication enforcement to the media file serving endpoint.
• No additional configuration changes are required.

Valters IT
DevSecOps & Cyber Threat Intelligence