Executive brief
Nautobot is a platform used for managing network infrastructure and automating IT tasks. A security flaw was found where users with permission to run a single automation task (Job) could bypass restrictions and run any task configured as a 'Job Button.' This could allow unauthorized users to perform administrative actions or disrupt network operations they should not have access to.
Technical details
An authorization bypass exists in Nautobot's Job Button execution logic. When a user invokes a Job via the `/extras/job-button/<uuid>/run/` endpoint, the application only verifies the model-level 'extras.run_job' permission rather than checking if the user has object-level permissions for that specific Job instance. This vulnerability specifically affects Jobs implemented as subclasses of 'JobButtonReceiver'. Additionally, the 'extras.run_jobbutton' permission was found to be unenforced by the backend view, relying solely on UI-level obfuscation. Attackers with low privileges (any job execution rights) can exploit this over the network to execute unauthorized automation tasks. The issue is resolved in versions 1.6.8 and 2.1.0.
Affected products
- Network to Code Nautobot >= 1.5.14, < 1.6.8; >= 2.0.0, < 2.1.0
Timeline
- 2023-12-22: disclosed
- 2023-12-22: advisory
- 2023-12-22: patched