Description
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netbox-community | netbox | 2.9.0 – < 4.7.4 | 4.7.4 |
References
- https://github.com/netbox-community/netbox/issues/23467 issue-tracking
- https://github.com/netbox-community/netbox/pull/23468 patch issue-tracking
- https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196 patch
- netbox v4.7.4 Release Notes release-notes
- https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352 technical-description
- VulnCheck Advisory: NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView third-party-advisory