Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Platform
python
Component
nautobot
Fixed in
3.1.2
Impact
Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing for various behaviors similar to server-side request forgery (SSRF).
Patches
Fixes are available in Nautobot v2.4.33 and v3.1.2.
In support of this fix, three new settings variables have been added to Nautobot:
WEBHOOKALLOWEDSCHEMES- By default new or updatedWebhookrecords will be restricted to HTTP or HTTPS only, disallowing other schemes that may have been previously allowed. Administrators should audit existingWebhookrecords to identify any that are invalid, and either update/delete said records or customizeWEBHOOKALLOWEDSCHEMESas appropriate.WEBHOOKADDITIONALBLOCKED_NETWORKS- This can be used to specify additional IP networks that should be denied toWebhooksending, for example some deployments may wish to disallow RFC1918 addresses or even disallow all networks and carve out specific exemptions using the following setting.WEBHOOKALLOWEDHOSTS- This can be used to provide an allow-list of specific hosts that would otherwise be blocked by anyWEBHOOKADDITIONALBLOCKED_NETWORKSconfiguration.
Workarounds
Administrators should review which users have been granted add or change permissions for the Webhook data model, and should review currently defined Webhook records for safety and validity. Other than that, no specific workaround has been identified.
References
- 2.4.33 (<a href="https://github.com/nautobot/nautobot/commit/16aa4aa9796ab7a31c4d615ec945e1f16d8c77c4">patch</a>)
- 3.1.2 (<a href="https://github.com/nautobot/nautobot/commit/7324c8f0d8c7245fbc691e15d729adc2d2707d08">patch</a>)
Detect this CVE in your project
Upload your requirements.txt file and we'll tell you instantly if you're affected.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Timeline
- Published
How to fix
No official patch available. Check for workarounds or monitor for updates.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your requirements.txt file and we'll tell you instantly if you're affected.
Scan your Python project now — no account
Upload your requirements.txt and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...