en.wikipedia.org
https://en.wikipedia.org/wiki/DNS_rebinding CVE-2023-47116
MEDIUM
Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Record summary
CVE-2023-47116 has a selected CVSS score of 5.3 (medium).
Description
Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
label-studioBrowse HumanSignal / label-studio | CVE List | < 1.11.0 | affected |
label-studioBrowse PyPI / label-studio | GitHub Advisory | Before 1.11.0 · Fixed in 1.11.0 | affected |
References
9github.com
https://github.com/HumanSignal/label-studio github.com
https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/core/utils/io.py github.com
https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/data_import/uploader.py github.com
https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64 github.com
https://github.com/HumanSignal/label-studio/releases/tag/1.11.0 github.comConfirmation
https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r github.com
https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-127.yaml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-47116