Remote code execution in Jinja2 template rendering in Nautobot

CVE-2023-25657

What is CVE-2023-25657?

Nautobot, a network automation platform, has a vulnerability enabling remote code execution in versions prior to 1.5.7. Due to inadequate sandboxing in Jinja2 template rendering, users are at risk of malicious code execution. The recently released version 1.5.7 incorporates sandboxed environments for key components, mitigating risks associated with unsafe template usage. While no active exploits have been confirmed, users are strongly encouraged to upgrade to secure their instances. For immediate protection, users can enforce sandboxing in their configurations. Details on adjustments to the nautobot_config.py file and further measures to limit specific object permissions are provided for those unable to perform upgrades promptly.

References