CVE-2025-62607: Nautobot SSoT Information Disclosure Flaw

CVE-2025-62607 Overview

CVE-2025-62607 is an information disclosure vulnerability in Nautobot Single Source of Truth (SSoT), an application that extends the Nautobot network automation platform. Versions prior to 3.10.0 expose a configuration page that unauthenticated attackers can reach over the network. The exposed page reveals the ServiceNow public instance name, such as companyname.service-now.com. The flaw is tracked as CWE-306: Missing Authentication for Critical Function. The vulnerability was patched in version 3.10.0.

Critical Impact
Unauthenticated network attackers can retrieve the configured ServiceNow instance name from the Nautobot SSoT configuration page. Secrets, credentials, and other Nautobot pages remain protected.

Affected Products

Nautobot Single Source of Truth (SSoT) app versions prior to 3.10.0
Nautobot deployments integrating the SSoT ServiceNow connector
Self-hosted Nautobot instances exposing the SSoT configuration page to untrusted networks

Discovery Timeline

2025-10-22 - CVE-2025-62607 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62607

Vulnerability Analysis

The vulnerability resides in the Nautobot SSoT app's ServiceNow configuration page. The page did not enforce authentication before rendering configuration metadata. An unauthenticated HTTP request to this endpoint returns the ServiceNow public instance name configured in Nautobot. This value identifies the tenant's ServiceNow environment, for example companyname.service-now.com.

The advisory classifies the exposed value as low-value information. The endpoint does not disclose the Secret object, Secret name, or Secret value used for ServiceNow authentication. Unauthenticated users cannot modify the instance name or assign secrets through the page. Access is scoped to this single configuration view and does not pivot to other Nautobot pages.

Root Cause

The root cause is missing authentication on a Django view that rendered SSoT configuration data [CWE-306]. The patch in version 3.10.0 restructures the affected components using NautobotModelSerializer and updates the UI and UIViewSet layer so that view access is gated through Nautobot's authentication framework.

Attack Vector

Exploitation requires only network reachability to the Nautobot web interface. No credentials, user interaction, or elevated privileges are needed. An attacker sends an HTTP GET request to the SSoT ServiceNow configuration URL and parses the ServiceNow instance name from the response. The disclosed hostname can support reconnaissance for follow-on attacks against the identified ServiceNow tenant.

python

# Security patch excerpt - nautobot_ssot/api/serializers.py
# Source: https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8

"""Django API serializers for nautobot_ssot app."""

from nautobot.apps.api import NautobotModelSerializer

from nautobot_ssot import models


class SyncSerializer(NautobotModelSerializer):  # pylint: disable=too-many-ancestors
    """Sync Serializer."""

    class Meta:
        """Meta attributes."""

        model = models.Sync
        fields = "__all__"


class SyncLogEntrySerializer(NautobotModelSerializer):  # pylint: disable=too-many-ancestors
    """SyncLogEntry Serializer."""

    class Meta:
        """Meta attributes."""

        model = models.SyncLogEntry
        fields = "__all__"

The commit refactors the SSoT app to use standard Nautobot serializers and UI view sets, aligning access control with the parent framework. See the GitHub commit details for the full patch.

Detection Methods for CVE-2025-62607

Indicators of Compromise

Unauthenticated HTTP GET requests targeting the Nautobot SSoT ServiceNow configuration path from external or unexpected internal source IPs.
Web server access logs showing HTTP 200 responses on SSoT configuration endpoints without an authenticated session cookie.
Reconnaissance traffic patterns that follow disclosure with lookups against the identified *.service-now.com hostname.

Detection Strategies

Review Nautobot access logs for anonymous requests to SSoT URLs and correlate against installed app version.
Inventory Nautobot installations to identify any SSoT app version below 3.10.0.
Alert on external requests to Nautobot admin or configuration paths that succeed without authentication.

Monitoring Recommendations

Forward Nautobot web application and reverse proxy logs to a central log platform for query and retention.
Baseline expected authenticated traffic to SSoT endpoints and flag deviations.
Monitor DNS and outbound traffic for reconnaissance activity against the ServiceNow instance hostname referenced by Nautobot.

How to Mitigate CVE-2025-62607

Immediate Actions Required

Upgrade the Nautobot SSoT app to version 3.10.0 or later on all Nautobot instances.
Restrict network access to the Nautobot web interface using firewall rules, VPN, or reverse proxy authentication until patching is complete.
Audit exposure by querying web logs for prior unauthenticated hits on SSoT configuration URLs.

Patch Information

The fix is included in Nautobot SSoT version 3.10.0. Refer to the GitHub Release v3.10.0 notes and the GitHub Security Advisory GHSA-535g-62r7-cx6v for full remediation guidance. The upstream commit 1530d25cdeb929641ec47644f9a0a1d9d41e1cb8 introduces the authenticated serializer and UI view set changes that resolve the missing authentication check.

Workarounds

Place the Nautobot web interface behind a reverse proxy that enforces authentication on all paths, including SSoT configuration URLs.
Limit inbound access to Nautobot to trusted management networks via network access control lists.
Rotate the ServiceNow integration credentials if reconnaissance activity is suspected, even though the Secret value is not exposed by this flaw.

bash

# Example: upgrade Nautobot SSoT app to a patched version
pip install --upgrade 'nautobot-ssot>=3.10.0'

# Verify installed version
pip show nautobot-ssot | grep -i version

# Restart Nautobot services after upgrade
sudo systemctl restart nautobot nautobot-worker