CVE-2020-23534
📋 TL;DR
This SSRF vulnerability in gopeak masterlab 2.1.5 allows attackers to make arbitrary HTTP requests from the vulnerable server via the 'source' parameter in Upgrade.php. Attackers can potentially access internal services, perform port scanning, or interact with cloud metadata APIs. Organizations running masterlab 2.1.5 with internet-facing instances are affected.
💻 Affected Systems
- gopeak masterlab
📦 What is this software?
Masterlab by Masterlab
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via interaction with cloud metadata services (AWS/Azure/GCP) to obtain credentials, leading to lateral movement and data exfiltration.
Likely Case
Internal network reconnaissance, access to internal services, and potential data leakage from internal APIs.
If Mitigated
Limited to port scanning and basic network discovery if proper network segmentation and egress filtering are in place.
🎯 Exploit Status
Simple HTTP request manipulation required. GitHub issue includes proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.1.5
Vendor Advisory: https://github.com/gopeak/masterlab/issues/254
Restart Required: No
Instructions:
1. Upgrade to latest masterlab version. 2. Verify Upgrade.php no longer accepts arbitrary URLs in 'source' parameter. 3. Test upgrade functionality.
🔧 Temporary Workarounds
Block Upgrade.php Access
allRestrict access to Upgrade.php endpoint via web server configuration
# Apache: RewriteRule ^Upgrade\.php$ - [F]
# Nginx: location ~ /Upgrade\.php$ { deny all; }
Input Validation
allAdd validation to only allow specific, trusted sources for upgrades
# Modify Upgrade.php to validate 'source' parameter against whitelist
🧯 If You Can't Patch
- Implement strict network egress filtering to block outbound requests from web servers
- Deploy WAF rules to detect and block SSRF patterns in requests to Upgrade.php
🔍 How to Verify
Check if Vulnerable:
Attempt to access Upgrade.php with crafted 'source' parameter pointing to internal service or external validation service like burpcollaborator.netCheck Version:
Check masterlab version in admin panel or via package managerVerify Fix Applied:
Test that Upgrade.php rejects arbitrary URLs and only accepts validated upgrade sources📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from web server
- Requests to Upgrade.php with unusual 'source' parameters
- Access to internal IP addresses from web server
Network Indicators:
- Web server making unexpected outbound HTTP requests
- Requests to cloud metadata endpoints from web server
SIEM Query:
source="web_server_logs" AND uri="/Upgrade.php" AND (source_param CONTAINS "http://" OR source_param CONTAINS "https://")