Is CVE-2023-51649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-51649 being exploited in the wild.

How severe is CVE-2023-51649?

Low severity, with a CVSS score of 3.5, published 22 December 2023.

Which products and versions are affected?

nautobot (PyPI) ECOSYSTEM:introduced=1.5.14,fixed=1.6.8, ECOSYSTEM:introduced=1.5.14,fixed=1.6.8,introduced=2.0.0,fixed=2.1.0.

Is there a fix for CVE-2023-51649?

Yes. nautobot (PyPI): upgrade to 1.6.8, 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-51649 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2023-51649?

Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-51649: Nautobot incorrect authorization in Job Buttons

CVE-2023-51649 · Severity: low · CVSS 3.5 · Published 2023-12-22

Nautobot is a platform used for managing network infrastructure and automating IT tasks. A security flaw was found where users with permission to run a single automation task (Job) could bypass restrictions and run any task configured as a 'Job Button.' This could allow unauthorized users to perform administrative actions or disrupt network operations they should not have access to.

Technologies: nautobot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-51649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-51649 being exploited in the wild.
How severe is CVE-2023-51649?: Low severity, with a CVSS score of 3.5, published 22 December 2023.
Which products and versions are affected?: nautobot (PyPI) ECOSYSTEM:introduced=1.5.14,fixed=1.6.8, ECOSYSTEM:introduced=1.5.14,fixed=1.6.8,introduced=2.0.0,fixed=2.1.0.
Is there a fix for CVE-2023-51649?: Yes. nautobot (PyPI): upgrade to 1.6.8, 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-51649 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-51649?: Check whether you run nautobot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nautobot (PyPI): upgrade to 1.6.8, 2.1.0 or later
```
pip install "nautobot>=2.1.0"
```

Technical details

An authorization bypass exists in Nautobot's Job Button execution logic. When a user invokes a Job via the `/extras/job-button/<uuid>/run/` endpoint, the application only verifies the model-level 'extras.run_job' permission rather than checking if the user has object-level permissions for that specific Job instance. This vulnerability specifically affects Jobs implemented as subclasses of 'JobButtonReceiver'. Additionally, the 'extras.run_jobbutton' permission was found to be unenforced by the backend view, relying solely on UI-level obfuscation. Attackers with low privileges (any job execution rights) can exploit this over the network to execute unauthorized automation tasks. The issue is resolved in versions 1.6.8 and 2.1.0.

Affected products

Network to Code Nautobot >= 1.5.14, < 1.6.8; >= 2.0.0, < 2.1.0

Identifiers

CVE-2023-51649
GHSA-vf5m-xrhm-v999
PYSEC-2023-287

Timeline

2023-12-22: disclosed
2023-12-22: advisory
2023-12-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.