HumanSignal label-studio up to 1.10.x Environment Variable SSRF_PROTECTION_ENABLED server-side request forgery

Summaryinfo

A vulnerability described as critical has been identified in HumanSignal label-studio up to 1.10.x. Impacted is an unknown function of the component Environment Variable Handler. Such manipulation of the argument SSRF_PROTECTION_ENABLED leads to server-side request forgery. This vulnerability is listed as CVE-2023-47116. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in HumanSignal label-studio up to 1.10.x. Affected by this issue is an unknown code block of the component Environment Variable Handler. The manipulation of the argument SSRF_PROTECTION_ENABLED with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality. CVE summarizes:

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.

The weakness was presented 01/31/2024 as GHSA-p59w-9gqw-wj8r. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-47116 since 10/30/2023. There are known technical details, but no exploit is available.

Upgrading to version 1.11.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 55dd6af4716b92f2bb213fe461d1ffbc380c6a64 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• HumanSignal

Name

• label-studio

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10

License

• open-source

Website

• Product: https://github.com/HumanSignal/label-studio/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion