Security vulnerability

[nguyendangtoan]

I discovered a security vulnerability on the netbox, how can I send it to the security team?

[jeremystretch]

Please share some details about what you've found, and we'll decide how best to proceed.

[nguyendangtoan]

This vulnerability is an insecure direct object reference (IDOR) that allows unauthenticated users to obtain sensitive information about: username, email, hashed password, device information, ...

[nguyendangtoan]

but attacker can see and attack netbox application found on internet

[candlerb]

Is this a security vulnerability in Django, or one of the other components like djangorestframework, or actually in Netbox's own code (meaning Netbox is using one of those components wrongly?)

[kkthxbye-code]

@nguyendangtoan - Guessing from your discription it seems like graphql, so I tested it and you can fetch users with all their fields unauthenticated. I spoke to jeremy on slack and he's fine with it being raised in a ticket. So feel free to make a bug report.

[nguyendangtoan]

@kkthxbye-code Yes,this vulnerability from graphql, any user can get information without authentication

[jeremystretch]

any user can get information without authentication

That's not quite accurate. The GraphQL API endpoint is still subject to the global authentication requirement (LOGIN_REQUIRED), so users must still authenticate to make queries, unless this has been disabled.

[jeremystretch]

This has been addressed under bug #7814. It will be resolved in v3.0.10, which should be out soon.