Log in Start free

Vulnerability · Published Nov 9, 2023 · Assigned by GitHub_M

CVE-2023-43791Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Critical 9.8

In plain English

A critical-severity information exposure in label-studio from HumanSignal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.2%top 30.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlabel-studio1.8.2GHSA-f475-x83m-rx5m
PyPIlabel-studio1.8.2PYSEC-2023-274

Affected products (as reported)

VendorProductVersions
HumanSignal label-studio <= 1.8.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References