ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)

ExploitDBExploitDB exploitExploitEDB-52551

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that automates a two-step SSRF exploit against ThingsBoard IoT Platform 4.2.0. It uploads a crafted SVG file containing an external URL reference to the Image Upload Gallery API, then creates a dashboard widget embedding the uploaded SVG's public link to trigger a server-side request to the attacker-specified internal URL.

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward SSRF exploit against ThingsBoard. It uploads a user-supplied SVG file and creates a widget embedding the returned public link. All network requests target the configured ThingsBoard instance (localhost:8080 by default) using the provided bearer token. No hidden or unrelated outbound connections, persistence mechanisms, credential exfiltration, or deceptive payloads are present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareThingsBoard IoT Platform
Attack typesServer-Side Request Forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs the steps required to exploit the SSRF vulnerability: it uploads a malicious SVG and creates a widget that causes the server to issue a request to an attacker-controlled internal URL. This goes beyond detection or scanning; it exercises the vulnerability to achieve the SSRF effect.

exploits/multiple/webapps/52551.py:24-28exploits/multiple/webapps/52551.py:142-161

Requirements

  • Requires a valid Tenant Admin bearer token for the target ThingsBoard instance.exploits/multiple/webapps/52551.py:20-22
  • Requires a crafted SVG file containing a remote URL reference (e.g., http://127.0.0.1:5555) to be uploaded.exploits/multiple/webapps/52551.py:15-18
  • Target ThingsBoard instance must be running and accessible at the default localhost URLs (configurable in code).exploits/multiple/webapps/52551.py:57-60

Observed behavior

  • Uploads a user-supplied SVG file to the /api/image endpoint using a multipart POST request with the provided bearer token.exploits/multiple/webapps/52551.py:62-91
  • Extracts the publicLink from the upload response and uses it to construct a widget payload containing an <object> tag that references the uploaded SVG.exploits/multiple/webapps/52551.py:102-108
  • Creates a new widget type via POST /api/widgetType, embedding the SVG public link, which when rendered by the server triggers a fetch of the external URL referenced in the SVG.exploits/multiple/webapps/52551.py:93-140
  • Prints success messages instructing the user to add the created widget to a dashboard to trigger the SSRF.exploits/multiple/webapps/52551.py:159-161
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
http://localhost:8080The script hardcodes the target ThingsBoard server. All API calls (image upload, widget creation) are directed to this host.exploits/multiple/webapps/52551.py:57-60
Credential Usage
Bearer token passed via CLI argument or TB_TOKEN environment variableThe token is used only in the X-Authorization header for the intended API calls. It is not exfiltrated or sent to any third party.exploits/multiple/webapps/52551.py:79exploits/multiple/webapps/52551.py:95exploits/multiple/webapps/52551.py:170
File Upload
User-supplied SVG file uploaded to /api/imageThe script reads a local SVG file and uploads it to the target server. The file content is not modified or inspected by the script; the SSRF is triggered server-side when the SVG is processed.exploits/multiple/webapps/52551.py:62-91
Review boundaries

What the analysis did not establish

  • The evidence consists solely of the Python script; no SVG payload file is included, so the exact content of the malicious SVG is only described in comments.
  • The script hardcodes default target URLs to localhost:8080; it does not accept a target host argument, limiting flexibility without code modification.
  • No network traffic or server responses are captured to confirm successful exploitation; classification is based on code intent and described behavior.
  • The review covers only the supplied exploit script. External dependencies (the 'requests' library) and the referenced SVG payload file are not included in the evidence and were not analyzed.
  • The script's behavior depends on the content of the user-supplied SVG file; a malicious SVG could contain additional payloads, but that is outside the scope of this script review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1