CVE-2023-48700: Clear Text Credentials Exposed via Onboarding Task in nautobot-device-onboarding
Summary
CVE-2023-48700: Clear Text Credentials Exposed via Onboarding Task. Affects nautobot-device-onboarding versions >= 2.0.0, < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nautobot-device-onboarding is a Python package available on PyPI that provides functionality for device onboarding in the Nautobot network automation platform. It allows users to create OnboardingTasks and specify credentials for device onboarding. These credentials are used during the execution of Celery Tasks. However, in versions 2.0.0 to 2.0.2 of nautobot-device-onboarding, the credentials provided during OnboardingTask creation are exposed in clear text in the Job Results view under the Additional Data tab. This vulnerability does not affect earlier versions or when using NAPALM_USERNAME and NAPALM_PASSWORD from nautobot_config.py.
Vulnerability Detail
The vulnerability allows an attacker with access to the Job Results view to view the clear text credentials used during OnboardingTask execution. This can lead to unauthorized access to devices and sensitive information. The vulnerability has a CVSSv3 score of 8.0, indicating a high severity level. It only affects nautobot-device-onboarding versions 2.0.0 to 2.0.2.
How To Fix
Minimum fixed version
3.0.0
This is the first release that contains the fix.
pip install --upgrade "nautobot-device-onboarding==3.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in nautobot-device-onboarding allows clear text credentials to be exposed via the Job Results view. To mitigate the risk, it is recommended to upgrade to version 3.0.0 of the package and rotate any exposed credentials. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nautobot-device-onboarding →
FAQ
Versions 2.0.0 to 2.0.2 of nautobot-device-onboarding are affected by this vulnerability. Earlier versions and versions 3.0.0 and above are not affected.
You can check the version of nautobot-device-onboarding installed on your system. If it is version 2.0.0 to 2.0.2, your system is vulnerable. You can also use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability.
The exposure of clear text credentials can lead to unauthorized access to devices and sensitive information. Attackers can use the credentials to gain control over the network and perform malicious actions.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to version 3.0.0 of nautobot-device-onboarding.
To rotate the exposed credentials, you need to update the credentials used for device onboarding. Generate new credentials and update the OnboardingTasks with the new credentials.
