Linuxfabrik Monitoring Plugins 6.0.0 SSRF Exposes BMC Credentials via Redfish Header
What Happened – A server‑side request forgery (SSRF) flaw in Linuxfabrik monitoring‑plugins ≤ 6.0.0 allows an attacker to craft an @odata.id value without a leading “/”. The plugin then re‑issues the request with the Redfish Authorization header attached, leaking the BMC’s session token to any host the attacker controls. The issue is tracked under GHSA‑96fx‑pqc3‑28xv and was patched in version 6.0.1.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses logical access controls, a core SOC 2 CC6.1 requirement, showing why continuous validation of application‑level controls is essential.
- Demonstrates the need for auditable evidence that SSRF mitigations (input validation, outbound request whitelisting) are in place and regularly tested.
- Directly ties to the “Security Awareness & Training” control set: developers must be able to prove they follow secure coding standards and that code reviews capture such injection vectors.
Who Is Affected – Organizations that run Linux‑based monitoring stacks (IT operations, cloud‑infra teams, data‑center providers) and any environment that integrates Redfish‑managed BMCs.
Recommended Actions –
- Upgrade to monitoring‑plugins 6.0.1 or later immediately.
- Add SSRF validation (allowlist of outbound hosts, strict URL parsing) and map the fix to SOC 2 CC6.1 controls.
- Capture remediation evidence (patch version, test scripts, scan results) for audit readiness.
Source: Exploit‑DB #52653
Technical Notes – The vulnerability exploits an @odata.id value that rewrites request authority, causing the plugin to forward the Redfish Authorization header to an attacker‑controlled endpoint. No CVE was assigned; the advisory is GHSA‑96fx‑pqc3‑28xv. The exploit is a proof‑of‑concept Python harness that runs locally; no persistence or destructive payload is delivered. Source: GitHub advisory