Incomplete List of Disallowed Inputs in Nautobot - #VU155748

Vulnerability details

The vulnerability allows a remote user to disclose sensitive information and take over other users' accounts.

The vulnerability exists due to incomplete restrictions on sensitive field access in Nautobot's Jinja2 template environment when rendering user-authored templates with a live object or queryset in the context. A remote user can author and render a template that accesses sensitive fields through queryset projections to disclose sensitive information and take over other users' accounts.

Only deployments with STRICT_SENSITIVE_FIELDS set to False, its default value, are affected. Exposed credentials include other users' REST API token keys and password hashes, including those belonging to administrators. A disclosed API token grants its owner's full REST API privileges.

Affected software

Remediation

External References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-5q66-3x3p-rxmh
• https://github.com/nautobot/nautobot/commit/35dc20e4d47304ec346a0d8f20a9f6478718f12b

Related Security Bulletins

• Multiple vulnerabilities in Nautobot