Improper Authorization in Nautobot - #VU155744

Vulnerability details

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in Nautobot's REST API cable trace and path endpoints when traversing cable paths and serializing objects without enforcing their object-level view permissions. A remote user can send a GET request to a trace or paths endpoint for an object they are permitted to view to disclose sensitive information.

Exposure occurs only in deployments that use constrained ObjectPermission rules to limit view access to cable terminations, cables, or their parent devices. Disclosed information is limited to objects along the cable path from the requested object; unrelated objects cannot be arbitrarily enumerated. The corresponding UI cable trace view is not affected.

Affected software

Remediation

External References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-m6h7-g92h-9p44
• https://github.com/nautobot/nautobot/commit/3bca201bf8a7f33be1cf792110e46e720bfaf38c

Related Security Bulletins

• Improper Authorization in Nautobot