{"id":"GHSA-cf9f-wmhp-v4pr","summary":"Cross-site Scripting potential in custom links, job buttons, and computed fields","details":"### Impact\n\nAll users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected.\n\nDue to incorrect usage of Django's `mark_safe()` API when rendering certain types of user-authored content, including:\n\n- custom links\n- job buttons\n- computed fields\n\nit is possible that users with permission to create or edit these types of content could craft a malicious payload (such as JavaScript code) that would be executed when rendering pages containing this content.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nWe have fixed the incorrect uses of `mark_safe()` (generally by replacing them with appropriate use of `format_html()` instead) to prevent such malicious data from being executed.\n\nUsers on Nautobot 1.6.x LTM should upgrade to v1.6.6 and users on Nautobot 2.0.x should upgrade to v2.0.5.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAppropriate object permissions can and should be applied to restrict which users are permitted to create or edit the aforementioned types of user-authored content. Other than that, there is no direct fix available.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- https://github.com/nautobot/nautobot/pull/4832\n- https://github.com/nautobot/nautobot/pull/4833\n- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html\n- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe","aliases":["CVE-2023-48705","PYSEC-2023-285"],"modified":"2024-11-22T18:28:50.805663Z","published":"2023-11-22T20:55:54Z","database_specific":{"github_reviewed_at":"2023-11-22T20:55:54Z","nvd_published_at":"2023-11-22T16:15:09Z","cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-cf9f-wmhp-v4pr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48705"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/pull/4832"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/pull/4833"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/commit/362850f5a94689a4c75e3188bf6de826c3b012b2"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/commit/54abe23331b6c3d0d82bf1b028c679b1d200920d"},{"type":"WEB","url":"https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html"},{"type":"WEB","url":"https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe"},{"type":"PACKAGE","url":"https://github.com/nautobot/nautobot"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-285.yaml"}],"affected":[{"package":{"name":"nautobot","ecosystem":"PyPI","purl":"pkg:pypi/nautobot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.0b4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.10","1.2.11","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.2","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-cf9f-wmhp-v4pr/GHSA-cf9f-wmhp-v4pr.json"}},{"package":{"name":"nautobot","ecosystem":"PyPI","purl":"pkg:pypi/nautobot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-cf9f-wmhp-v4pr/GHSA-cf9f-wmhp-v4pr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L"}]}