Netbox Community
Monthly
Credential exposure in NetBox through 4.7.0 allows any authenticated user with only view-level permissions to retrieve plaintext Git passwords and Amazon S3 secret access keys via the REST API and GraphQL interfaces. The flaw is rooted in missing field-level redaction in the API serializer and GraphQL type layer, and represents an incomplete remediation of a previously reported issue (GitHub issue #12625). A public proof-of-concept is available, and successful exploitation grants attackers direct access to external Git repositories and S3 storage buckets configured as NetBox data source backends - extending the breach well beyond the NetBox instance itself.
Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary Python code as the NetBox service user by injecting malicious callables into Jinja2 template environment parameters. Attackers bypass SandboxedEnvironment protections by setting the finalize parameter to dangerous imports like subprocess.getoutput, which executes on every rendered expression outside sandbox call interception. Public proof-of-concept exploit exists (chocapikk.com), and upstream patch available via GitHub PR #22078 implements an allowlist-based validation mechanism that blocks unauthorized callable resolution at both save-time and render-time.
Cross-user disclosure in NetBox through 4.7.0 exposes all users' private Notifications, Subscriptions, and Bookmark records to any authenticated user with standard view permissions, via unscoped querysets in both the REST API and GraphQL API. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): affected endpoints return the full table rather than filtering records to the requesting user's identity. A publicly available proof-of-concept exists demonstrating exploitation against a default 4.7.0 installation; no active exploitation has been confirmed in CISA KEV.
Credential exposure in NetBox through 4.7.0 allows any authenticated user with only view-level permissions to retrieve plaintext Git passwords and Amazon S3 secret access keys via the REST API and GraphQL interfaces. The flaw is rooted in missing field-level redaction in the API serializer and GraphQL type layer, and represents an incomplete remediation of a previously reported issue (GitHub issue #12625). A public proof-of-concept is available, and successful exploitation grants attackers direct access to external Git repositories and S3 storage buckets configured as NetBox data source backends - extending the breach well beyond the NetBox instance itself.
Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary Python code as the NetBox service user by injecting malicious callables into Jinja2 template environment parameters. Attackers bypass SandboxedEnvironment protections by setting the finalize parameter to dangerous imports like subprocess.getoutput, which executes on every rendered expression outside sandbox call interception. Public proof-of-concept exploit exists (chocapikk.com), and upstream patch available via GitHub PR #22078 implements an allowlist-based validation mechanism that blocks unauthorized callable resolution at both save-time and render-time.
Cross-user disclosure in NetBox through 4.7.0 exposes all users' private Notifications, Subscriptions, and Bookmark records to any authenticated user with standard view permissions, via unscoped querysets in both the REST API and GraphQL API. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): affected endpoints return the full table rather than filtering records to the requesting user's identity. A publicly available proof-of-concept exists demonstrating exploitation against a default 4.7.0 installation; no active exploitation has been confirmed in CISA KEV.