CVE-2023-51649 : Exploit Details and Defense Strategies

Nautobot missing object-level permissions enforcement when running Job Buttons.

Understanding CVE-2023-51649

This CVE affects Nautobot, which is a Network Source of Truth and Network Automation Platform. The vulnerability arises when submitting a Job to run via a Job Button without proper object-level permissions enforcement.

What is CVE-2023-51649?

Nautobot allows users to run Jobs via Job Buttons without proper object-level permissions enforcement. This means that users with permission to run one Job can exploit the vulnerability to run all configured JobButton Jobs.

The Impact of CVE-2023-51649

The impact of this vulnerability is rated low, with a CVSS base score of 3.5. It has a low base severity, no impact on confidentiality and integrity, low availability impact, and requires low privileges to exploit. The attack vector is through the network with high attack complexity.

Technical Details of CVE-2023-51649

Nautobot versions affected include >= 1.5.14 and < 1.6.8, as well as >= 2.0.0 and < 2.1.0. The issue stems from the lack of object-level permissions enforcement when running Job Buttons.

Vulnerability Description

When submitting a Job to run via a Job Button, only the model-level

extras.run_job

permission is checked, neglecting object-level permissions. This allows users with Job permissions to run all configured JobButton Jobs.

Affected Systems and Versions

Vendor: Nautobot
Product: Nautobot
Versions affected: >= 1.5.14, < 1.6.8 and >= 2.0.0, < 2.1.0

Exploitation Mechanism

The vulnerability can be exploited by users with permission to run even a single Job, granting them access to run all configured JobButton Jobs.

Mitigation and Prevention

It is crucial to take immediate steps to address and prevent exploitation of this vulnerability in Nautobot.

Immediate Steps to Take

Users are advised to update their Nautobot installations to versions 1.6.8 and 2.1.0, where the fix for this issue is available.

Long-Term Security Practices

Implementing strict object-level permissions enforcement and regularly updating Nautobot to the latest secure versions are recommended security practices.

Patching and Updates

Regularly check for security updates from Nautobot and apply patches promptly to ensure the security of your network automation platform.