NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Netbox Netbox
cpe:2.3:a:netbox:netbox:*:*:*:*:*:*:*:*
|
— |
<= 4.7.0
|
References 7
https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-sourc…
disclosure@vulncheck.com
https://github.com/netbox-community/netbox
disclosure@vulncheck.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/api/serializ…
disclosure@vulncheck.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/data_backend…
disclosure@vulncheck.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/core/graphql/type…
disclosure@vulncheck.com
https://github.com/netbox-community/netbox/issues/12625
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/netbox-through-4.7.0-credential-disclosure…
disclosure@vulncheck.com