Improper Neutralization of Special Elements Used in a Template Engine in Nautobot - #VU155746

Vulnerability details

The vulnerability allows a remote user to disclose sensitive database information and take over other users' accounts.

The vulnerability exists due to improper neutralization of special elements in the Jinja2 template engine when rendering user-authored templates in Nautobot. A remote user can author a template that escapes the sandbox and runs database read queries to disclose sensitive database information and take over other users' accounts.

Exploitation requires permission to author templates. Confirmed rendering paths include Computed Fields, Export Templates and Custom Links. Disclosed cleartext API tokens carry their owners' full REST API privileges. In the Custom Link case, the stored template evaluates when another user views the object, without further action by its author.

Affected software

Remediation

External References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-9fgc-m542-2g84
• https://github.com/nautobot/nautobot/commit/35dc20e4d47304ec346a0d8f20a9f6478718f12b

Related Security Bulletins

• Multiple vulnerabilities in Nautobot