Cyber Posture

CVE-2025-25297

HighPublic PoC

Published: 14 February 2025

Published
14 February 2025
Modified
25 August 2025
KEV Added
—
Patch
—
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0005 15.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may steal data by exfiltrating it over an existing command and control channel.

Security Summary

CVE-2025-25297 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting Label Studio, an open-source data labeling tool, in versions prior to 1.16.0. The issue resides in the S3 storage integration feature, specifically the endpoint configuration. When creating an S3 storage connection, users can specify a custom S3 endpoint URL via the s3_endpoint parameter, which is passed directly to the boto3 AWS SDK without validation of the protocol or destination. This allows arbitrary HTTP requests to internal services when the storage sync operation is triggered.

Unauthenticated remote attackers (AV:N/AC:L/PR:N/UI:N) can exploit this vulnerability over the network with low complexity and no user interaction. By setting the s3_endpoint to target internal services, attackers cause the application to issue S3 API calls to those endpoints during sync operations. The responses from these requests appear in error messages, including full response bodies, enabling attackers to bypass network segmentation, access otherwise isolated internal services, and exfiltrate sensitive data. The vulnerability has a CVSS v3.1 base score of 8.6, with high confidentiality impact and changed scope (S:C/C:H/I:N/A:N).

The patch is available in Label Studio version 1.16.0. Official advisories and the fixing commit are documented on GitHub at https://github.com/HumanSignal/label-studio/security/advisories/GHSA-m238-fmcw-wh58 and https://github.com/HumanSignal/label-studio/commit/06a2b29c1208e1878ccae66e6b84c8b24598fa79.

Label Studio's role as a data labeling tool gives this vulnerability relevance to AI/ML workflows, where it may be deployed to annotate datasets for model training. No public information on real-world exploitation is available.

Details

CWE(s)
CWE-918

Affected Products

humansignal
label studio
≤ 1.16.0

MITRE ATT&CK Enterprise Techniques

T1018 Remote System Discovery Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
T1082 System Information Discovery Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1041 Exfiltration Over C2 Channel Exfiltration
Adversaries may steal data by exfiltrating it over an existing command and control channel.
attack.mitre.org →
Why these techniques?

SSRF via unvalidated S3 endpoint allows direct internal HTTP requests, enabling remote system discovery (T1018), network service discovery (T1046), system information discovery from responses (T1082), access to data on local/internal systems (T1005), and exfiltration of sensitive data through error message responses (T1041).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References