CVE-2020-16248 : Security Advisory and Response

Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. This vulnerability is disputed and may be interpreted as both intended functionality and a vulnerability.

Understanding CVE-2020-16248

What is CVE-2020-16248?

Prometheus Blackbox Exporter through version 0.17.0 is susceptible to Server-Side Request Forgery (SSRF) via the /probe?target= endpoint.

The Impact of CVE-2020-16248

This vulnerability could potentially allow an attacker to manipulate the server into making malicious requests on behalf of the server itself, leading to unauthorized access or data leakage.

Technical Details of CVE-2020-16248

Vulnerability Description

The vulnerability in Prometheus Blackbox Exporter through 0.17.0 allows SSRF via the /probe?target= endpoint, enabling attackers to potentially exploit the server.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions affected: Up to and including 0.17.0

Exploitation Mechanism

Attackers can exploit this vulnerability by sending crafted requests to the /probe?target= endpoint, tricking the server into making unauthorized requests.

Mitigation and Prevention

Immediate Steps to Take

Monitor and restrict access to the affected endpoint (/probe?target=)
Implement input validation to prevent malicious requests

Long-Term Security Practices

Regularly update Prometheus Blackbox Exporter to the latest version
Conduct security assessments and penetration testing to identify and address vulnerabilities

Patching and Updates

Apply patches or updates provided by Prometheus to address this vulnerability