SSRF Vulnerability in Linuxfabrik monitoring-plugins Leading to Credential Leak

Security researchers have identified a Server-Side Request Forgery (SSRF) vulnerability in Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The flaw exists within the plugin's interaction with Redfish-compatible Baseboard Management Controllers (BMC). Specifically, when the plugin processes an @odata.id attribute that lacks a leading forward slash, it improperly rewrites the request authority.

When this occurs, the plugin initiates a new request to the attacker-controlled authority, mistakenly including the sensitive 'Authorization' header containing the BMC credentials. This allows an attacker positioned to influence the @odata.id response from a BMC or an intermediate proxy to intercept the credentials. This vulnerability is tracked under GHSA-96fx-pqc3-28xv and was addressed in version 6.0.1.

Impact

The vulnerability results in the unauthorized disclosure of BMC credentials, which could lead to full administrative compromise of affected server hardware. By obtaining these credentials, an attacker can gain persistent access to the management interface, potentially allowing them to modify hardware configurations, power-cycle systems, or access sensitive diagnostic data.

Recommendation

• Upgrade to Linuxfabrik monitoring-plugins version 6.0.1 or later immediately.
• Audit logs for unauthorized egress traffic originating from the monitoring server, specifically focusing on connections to unknown or unexpected external IP addresses on management-related ports.
• Implement network-level segmentation to restrict the monitoring server's ability to initiate connections to unauthorized external hosts.