netbox-proxbox
netbox-proxbox copied to clipboard
dont show token value on proxbox plugin page
when visiting the proxbox plugin page: eg demo.netbox.dev/plugins/proxbox/ the user token is displayed in full. this should be considered a secret and not shown in the gui
This was caught during an infrastructure audit at an organization I'm active at, and would have allowed root access to all VMs (via the VM.Monitor permission).
Even worse, default NetBox installations seem to show the plugins page / details even to logged out users...