CVE-2023-46128 : Security Advisory and Response

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the

?depth=<N>

query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

Understanding CVE-2023-46128

This CVE involves the exposure of hashed user passwords via REST API in Nautobot.

What is CVE-2023-46128?

The vulnerability in Nautobot 2.0.x allows authenticated users to access hashed user passwords stored in the database through specific REST API endpoints when using the

?depth=<N>

query parameter.

The Impact of CVE-2023-46128

The impact of this vulnerability is that it exposes sensitive information, specifically hashed user passwords, potentially compromising user security and confidentiality.

Technical Details of CVE-2023-46128

In this section, we will delve into the vulnerability description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability allows authenticated users to retrieve hashed user passwords through certain REST API endpoints by utilizing the

?depth=<N>

query parameter.

Affected Systems and Versions

Nautobot versions from 2.0.0 to 2.0.2 are affected by this vulnerability, with the issue being resolved in version 2.0.3.

Exploitation Mechanism

Authenticated users with access to specific REST API endpoints and knowledge of the

?depth=<N>

query parameter can exploit this vulnerability to retrieve hashed user passwords.

Mitigation and Prevention

Protecting your system from CVE-2023-46128 requires immediate action and long-term security practices to ensure the confidentiality of user data.

Immediate Steps to Take

Immediately update Nautobot to version 2.0.3 or higher to patch the vulnerability and prevent further exposure of hashed passwords.

Long-Term Security Practices

Regularly monitor and audit API endpoints, implement access controls, and enforce secure password storage practices to mitigate similar vulnerabilities in the future.

Patching and Updates

Stay informed about security advisories from Nautobot and promptly apply patches and updates to address known vulnerabilities.