// For flags

CVE-2023-51649

Nautobot missing object-level permissions enforcement when running Job Buttons

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

Nautobot es una Network Automation Platform y Network Source of Truth creada como una aplicación web sobre el framework Django Python con una base de datos PostgreSQL o MySQL. Al enviar un Job para ejecutar a través de un botón de Job, solo se verifica el permiso `extras.run_job` a nivel de modelo (es decir, si el usuario tiene permiso para ejecutar Jobs en general). Los permisos a nivel de objeto (es decir, ¿tiene el usuario permiso para ejecutar este trabajo específico?) no se aplican mediante la URL/vista utilizada en este caso. Un usuario con permisos para ejecutar incluso un solo Job puede ejecutar todos los Jobs de JobButton configurados. La solución estará disponible en Nautobot 1.6.8 y 2.1.0

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-20 CVE Reserved
  • 2023-12-22 CVE Published
  • 2024-01-04 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Networktocode
Search vendor "Networktocode"
 Nautobot
Search vendor "Networktocode" for product "Nautobot"
 >= 1.5.14 < 1.6.8
Search vendor "Networktocode" for product "Nautobot" and version " >= 1.5.14 < 1.6.8"
-
Affected
Networktocode
Search vendor "Networktocode"
 Nautobot
Search vendor "Networktocode" for product "Nautobot"
 >= 2.0.0 < 2.1.0
Search vendor "Networktocode" for product "Nautobot" and version " >= 2.0.0 < 2.1.0"
-
Affected