Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-36112

CVE-2024-36112: Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

6.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-36112
GHSA ID
GHSA-qmjf-wc2h-6x3q
EPSS Score
0.30951%
CWE
CWE-280
Published
5/29/2024
Updated
1/21/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
nautobotpip>= 1.3.0, < 1.6.231.6.23
nautobotpip>= 2.0.0, < 2.2.52.2.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from missing permission checks when accessing dynamic group members. The key evidence is in the commit diffs:- In api/views.py, the members endpoint changed from 'instance.members' to 'instance.members.restrict()'- In views.py, the UI table changed from 'instance.members' to 'instance.members.restrict()'These functions directly handled member object retrieval without applying Nautobot's permission system (restrict()), which normally enforces object-level permissions. The tests added in test_api.py and test_views.py explicitly validate the permission enforcement, confirming these were the vulnerable points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ * us*r wit* p*rmissions to vi*w *yn*mi* *roup r**or*s (`*xtr*s.vi*w_*yn*mi**roup` p*rmission) **n us* t** *yn*mi* *roup **t*il UI vi*w (`/*xtr*s/*yn*mi*-*roups/<uui*>/`) *n*/or t** m*m*

Reasoning

T** vuln*r**ility st*mm** *rom missin* p*rmission ****ks w**n ****ssin* *yn*mi* *roup m*m**rs. T** k*y *vi**n** is in t** *ommit *i**s:- In *pi/vi*ws.py, t** m*m**rs *n*point ***n*** *rom 'inst*n**.m*m**rs' to 'inst*n**.m*m**rs.r*stri*t()'- In vi*ws.