XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Impact

All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.

Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:

• Circuit.comments
• Cluster.comments
• CustomField.description
• Device.comments
• DeviceRedundancyGroup.comments
• DeviceType.comments
• Job.description
• JobLogEntry.message
• Location.comments
• Note.note
• PowerFeed.comments
• Provider.noc_contact
• Provider.admin_contact
• Provider.comments
• ProviderNetwork.comments
• Rack.comments
• Tenant.comments
• VirtualMachine.comments
• Contents of any custom fields of type markdown
• Job class description attributes
• The SUPPORT_MESSAGE system configuration setting

are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.

Patches

Fixed in Nautobot versions 1.6.10 and 2.1.2.

References

https://github.com/nautobot/nautobot/pull/5133
https://github.com/nautobot/nautobot/pull/5134