<p>Upgrade <code>label-studio</code> to version 1.11.0 or higher.</p>

Server-Side Request Forgery (SSRF) Affecting label-studio package, versions [,1.11.0)

Threat Intelligence

0.05% (23^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-PYTHON-LABELSTUDIO-6226341
published 1 Feb 2024
disclosed 31 Jan 2024
credit alex-elttam,isacaya

Report a new vulnerability Found a mistake?

Introduced: 31 Jan 2024

CVE-2023-47116 Open this link in a new tab CWE-918 Open this link in a new tab

How to fix?

Upgrade label-studio to version 1.11.0 or higher.

Overview

label-studio is a Label Studio annotation tool

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the validate_upload_url function. An attacker can bypass SSRF protections (SSRF_PROTECTION_ENABLED) and access internal web servers, potentially compromising the confidentiality of those servers by using HTTP redirection or performing a DNS rebinding attack.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

Low
Integrity (I)

None
Availability (A)

None