Nautobot up to 1.6.7/2.0.x Job Button authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in Nautobot up to 1.6.7/2.0.x. Impacted is an unknown function of the component Job Button Handler. Such manipulation leads to authorization. This vulnerability is listed as CVE-2023-51649. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Nautobot up to 1.6.7/2.0.x. It has been rated as problematic. Affected by this issue is an unknown functionality of the component Job Button Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is availability. CVE summarizes:

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

The weakness was presented 12/22/2023 as 4988. The advisory is available at github.com. This vulnerability is handled as CVE-2023-51649 since 12/20/2023. The technical details are unknown and an exploit is not available.

Upgrading to version 1.6.8 or 2.1.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Nautobot

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 2.0

Website

• Product: https://github.com/nautobot/nautobot/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion