An authenticated remote code execution vulnerability in NetBox versions 4.3.5 through 4.5.4 allows low-privilege users with export or config template permissions to execute arbitrary system commands.

This is an improper control of generation of code flaw in the RenderTemplateMixin.get_environment_params() method, where the application resolves user-supplied Jinja2 environment parameters using Django import_string without an allowlist, requiring low privileges for exploitation.

A successful exploit allows an authenticated attacker to achieve remote code execution as the NetBox service user, leading to complete system compromise, unauthorized data access, and potential lateral movement within the internal network. The high severity of this flaw is reflected in its CVSS score of 8.8, highlighting the critical threat to infrastructure confidentiality, integrity, and availability.

Immediate Action: Update NetBox to version 4.6.1 or later where the template parameter resolution flaw is resolved.

Proactive Monitoring: Monitor system logs for unusual process execution spawning from the NetBox service account, and review export or config template creation activities.

Compensating Controls: Restrict export and config template creation permissions exclusively to trusted administrative users until patches can be deployed.

Public Exploit Available: Yes, a public exploit and technical write-up are available via Chocapikk's cybersecurity blog and referenced research materials.

Given the availability of technical details and proof-of-concept write-ups detailing how to bypass the Jinja2 sandbox, organizations running vulnerable NetBox instances face significant risk. Administrators must apply the vendor security updates immediately to version 4.6.1 or later to eliminate the remote code execution vector.