GHSA-v4xv-795h-rv4h: XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-23345

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

High severity GitHub Reviewed Published Jan 22, 2024 in nautobot/nautobot • Updated Jan 23, 2024

Package

pip nautobot (pip)

Affected versions

>= 2.0.0, < 2.1.2

< 1.6.10

Patched versions

2.1.2

1.6.10

Description

Impact

All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.

Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:

• Circuit.comments
• Cluster.comments
• CustomField.description
• Device.comments
• DeviceRedundancyGroup.comments
• DeviceType.comments
• Job.description
• JobLogEntry.message
• Location.comments
• Note.note
• PowerFeed.comments
• Provider.noc_contact
• Provider.admin_contact
• Provider.comments
• ProviderNetwork.comments
• Rack.comments
• Tenant.comments
• VirtualMachine.comments
• Contents of any custom fields of type markdown
• Job class description attributes
• The SUPPORT_MESSAGE system configuration setting

are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.

Patches

Fixed in Nautobot versions 1.6.10 and 2.1.2.

References

nautobot/nautobot#5133
nautobot/nautobot#5134

References

• GHSA-v4xv-795h-rv4h
• https://nvd.nist.gov/vuln/detail/CVE-2024-23345
• nautobot/nautobot#5133
• nautobot/nautobot#5134
• nautobot/nautobot@17effcb
• nautobot/nautobot@64312a4

Published to the GitHub Advisory Database

Jan 23, 2024

Last updated

Jan 23, 2024