CVE-2023-50263: Unauthenticated db-file-storage views
(updated )
In Nautobot 1.x and 2.0.x, the URLs /files/get/?name=... and /files/download/?name=... are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs.
It was reported by @kircheneer that in the default implementation used in Nautobot, as provided by django-db-file-storage, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot’s FileProxy model instances.
Note that no URL mechanism is provided for listing or traversal of the available file name values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability.
References
- github.com/advisories/GHSA-75mc-3pjc-727q
- github.com/nautobot/nautobot
- github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91cee
- github.com/nautobot/nautobot/commit/5e2ba9e8ac0840b1c44eb1a8ea3c0bd2c68e4f80
- github.com/nautobot/nautobot/commit/7c4cf3137f45f1541f09f2f6a7f8850cd3a2eaee
- github.com/nautobot/nautobot/pull/4959
- github.com/nautobot/nautobot/pull/4964
- github.com/nautobot/nautobot/security/advisories/GHSA-75mc-3pjc-727q
- github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-286.yaml
- github.com/victor-o-silva/db_file_storage/blob/master/db_file_storage/views.py
- nvd.nist.gov/vuln/detail/CVE-2023-50263
Detect and mitigate CVE-2023-50263 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →