NetBox Community Cross-Site Scripting Vulnerability in Login Page

A cross-site scripting (XSS) vulnerability has been identified in the login page of NetBox Community version 4.1.7. This issue allows a privileged, authenticated attacker to exfiltrate user input from the login form.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into a NetBox Community 4.1.7 instance as a privileged user. Navigate to the login page and inject a script into the login form. Once the script is submitted, it will be executed, demonstrating the cross-site scripting vulnerability.