Summary
A server-side template injection vulnerability in NetBox custom link templates can expose sensitive request data to template expressions. A low-privileged user with permission to add custom links may cause session cookies or API tokens to be disclosed when a more privileged user views affected content, potentially enabling account takeover.
A server-side template injection vulnerability in NetBox custom link templates can expose sensitive request data to template expressions. A low-privileged user with permission to add custom links may cause session cookies or API tokens to be disclosed when a more privileged user views affected content, potentially enabling account takeover.
Affected context
The issue may occur in NetBox deployments where:
- Low-privileged users can create or modify custom links
- User-controlled templates are rendered with access to the raw Django HttpRequest object
- Template output is later displayed to privileged users
- HTML sanitization does not remove all browser-interpreted exfiltration paths
Exploitation depends on the relevant permission model, template rendering behavior, and whether privileged users view the affected object.
The issue may occur in NetBox deployments where:
- Low-privileged users can create or modify custom links
- User-controlled templates are rendered with access to the raw Django HttpRequest object
- Template output is later displayed to privileged users
- HTML sanitization does not remove all browser-interpreted exfiltration paths
Exploitation depends on the relevant permission model, template rendering behavior, and whether privileged users view the affected object.
Exploit preconditions
- Attack surface: NetBox custom link template rendering and subsequent browser display
- Required access: A user account with the ability to add custom links
- Trigger point: A privileged user viewing an object containing the attacker-controlled custom link
- Why exploitation is possible: Template expressions can access request-related data, while rendered output may still cause a victim's browser to transmit sensitive values to an external destination
- Attack surface: NetBox custom link template rendering and subsequent browser display
- Required access: A user account with the ability to add custom links
- Trigger point: A privileged user viewing an object containing the attacker-controlled custom link
- Why exploitation is possible: Template expressions can access request-related data, while rendered output may still cause a victim's browser to transmit sensitive values to an external destination
Why this happens
The underlying bug is the exposure of a raw request object to a user-controlled server-side template context. This creates a confused trust boundary in which template authors can access request attributes that should remain unavailable to untrusted content.
The issue maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled template content can influence rendered browser output. It also relates to CWE-668: Exposure of Resource to Wrong Sphere, since sensitive request data is made available to a less-trusted template context.
The underlying bug is the exposure of a raw request object to a user-controlled server-side template context. This creates a confused trust boundary in which template authors can access request attributes that should remain unavailable to untrusted content.
The issue maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled template content can influence rendered browser output. It also relates to CWE-668: Exposure of Resource to Wrong Sphere, since sensitive request data is made available to a less-trusted template context.
Potential impact
- Session cookies may be disclosed
- API tokens may be exposed
- A victim account may be taken over
- Attackers could perform actions available to compromised users
- Sensitive application data may be accessed or modified
- Administrative compromise could occur if a privileged account is affected
- Session cookies may be disclosed
- API tokens may be exposed
- A victim account may be taken over
- Attackers could perform actions available to compromised users
- Sensitive application data may be accessed or modified
- Administrative compromise could occur if a privileged account is affected
General mitigation guidance
Mitigation generally focuses on separating untrusted custom-link authors from sensitive request data and ensuring that rendered content cannot create unintended browser-side data flows.
Common defensive patterns include:
- Removing raw request objects and credential-bearing attributes from untrusted template contexts
- Exposing only a narrowly defined, allowlisted set of non-sensitive template variables
- Treating custom link templates as untrusted content and applying context-aware output encoding
- Enforcing strict, allowlisted URL and attribute policies after rendering
- Applying a restrictive Content Security Policy where compatible with application behavior
- Limiting custom-link creation to trusted roles and reviewing permission assignments
- Preventing session identifiers and API credentials from being exposed to client-rendered content
- Using secure cookie attributes and short-lived, narrowly scoped tokens to reduce residual risk
Mitigation generally focuses on separating untrusted custom-link authors from sensitive request data and ensuring that rendered content cannot create unintended browser-side data flows.
Common defensive patterns include:
- Removing raw request objects and credential-bearing attributes from untrusted template contexts
- Exposing only a narrowly defined, allowlisted set of non-sensitive template variables
- Treating custom link templates as untrusted content and applying context-aware output encoding
- Enforcing strict, allowlisted URL and attribute policies after rendering
- Applying a restrictive Content Security Policy where compatible with application behavior
- Limiting custom-link creation to trusted roles and reviewing permission assignments
- Preventing session identifiers and API credentials from being exposed to client-rendered content
- Using secure cookie attributes and short-lived, narrowly scoped tokens to reduce residual risk
How teams detect issues like this
Detection approaches may include:
- Static analysis rules that flag raw request objects or credential-related attributes exposed to template contexts
- Code review checks for server-side rendering of user-controlled templates
- Tests that verify sensitive request data is unavailable to custom-link authors
- Dynamic tests for unexpected external resource references in rendered custom-link output
- Content Security Policy and network monitoring for unusual outbound requests from administrative browsers
- Policy enforcement requiring review or approval for custom links that contain dynamic template expressions
Automated security review tools can help identify unsafe template context construction and missing output restrictions.
Detection approaches may include:
- Static analysis rules that flag raw request objects or credential-related attributes exposed to template contexts
- Code review checks for server-side rendering of user-controlled templates
- Tests that verify sensitive request data is unavailable to custom-link authors
- Dynamic tests for unexpected external resource references in rendered custom-link output
- Content Security Policy and network monitoring for unusual outbound requests from administrative browsers
- Policy enforcement requiring review or approval for custom links that contain dynamic template expressions
Automated security review tools can help identify unsafe template context construction and missing output restrictions.
