Label Studio erlaubt Server-Side Request Forgery im S3 Storage Endpoint

The SSRF vulnerability in Label Studio allows an attacker to bypass security controls and potentially access sensitive internal resources. By specifying a malicious S3 endpoint URL, an attacker can trick Label Studio into making requests to internal services that are not directly exposed to the internet. This could lead to data exfiltration, privilege escalation, or even remote code execution if the targeted internal service is vulnerable. The blast radius extends to any internal service accessible via HTTP, potentially compromising the entire internal network. This vulnerability shares similarities with other SSRF exploits where attackers leverage trusted applications to probe and access internal infrastructure.

Organizations utilizing Label Studio for data annotation and labeling, particularly those with sensitive internal services accessible via HTTP, are at risk. Environments with misconfigured S3 endpoints or insufficient network segmentation are especially vulnerable. Shared hosting environments running Label Studio should be carefully reviewed for potential exposure.

• python / server:

# Check for vulnerable Label Studio versions
ps aux | grep 'label-studio==[1.9.0-1.9.2.post0]' 

• generic web:

# Check for S3 endpoint configuration in Label Studio settings (if accessible)
curl -I http://<label-studio-host>/settings/storage | grep 's3_endpoint='

1. 2025-02-14Disclosure

   disclosure

1. Reserviert2025-02-06
2. Veröffentlicht2025-02-14
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-25297 is to upgrade Label Studio to version 1.16.0 or later, which includes the necessary fixes. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Label Studio server to only allow connections to authorized S3 endpoints. Implement strict input validation on the s3_endpoint parameter to prevent attackers from injecting malicious URLs. Consider using a Web Application Firewall (WAF) to filter out requests with suspicious S3 endpoint URLs. After upgrading, confirm the fix by attempting to create an S3 connection with a known malicious endpoint URL; the connection should fail with an appropriate error message.