Label Studio Sdk
Monthly
Authenticated users of Label Studio can turn the export converter into a full-read SSRF primitive: importing a task whose data.image points at an internal service and then requesting an export in YOLO_WITH_IMAGES, YOLO_OBB_WITH_IMAGES or COCO_WITH_IMAGES makes the server issue an HTTP GET to the attacker-chosen URL and write the response bytes into the ZIP the same user downloads, giving back the body rather than a blind probe. The same request can additionally leak the organization owner's long-lived API token to an attacker-controlled host when the Host header is spoofed so its netloc matches the task URL (ALLOWED_HOSTS defaults to '*'), though on a stock instance that token is inert while legacy_api_tokens_enabled stays off. Affected are Label Studio before 1.23.2 and label-studio-sdk before 2.1.2; the GitHub advisory contains a step-by-step proof-of-concept reproduction, and the issue is not listed in CISA KEV, so this is a genuine but mid-tier, this-month priority rather than an emergency.
Authenticated users of Label Studio can turn the export converter into a full-read SSRF primitive: importing a task whose data.image points at an internal service and then requesting an export in YOLO_WITH_IMAGES, YOLO_OBB_WITH_IMAGES or COCO_WITH_IMAGES makes the server issue an HTTP GET to the attacker-chosen URL and write the response bytes into the ZIP the same user downloads, giving back the body rather than a blind probe. The same request can additionally leak the organization owner's long-lived API token to an attacker-controlled host when the Host header is spoofed so its netloc matches the task URL (ALLOWED_HOSTS defaults to '*'), though on a stock instance that token is inert while legacy_api_tokens_enabled stays off. Affected are Label Studio before 1.23.2 and label-studio-sdk before 2.1.2; the GitHub advisory contains a step-by-step proof-of-concept reproduction, and the issue is not listed in CISA KEV, so this is a genuine but mid-tier, this-month priority rather than an emergency.