CVE-2023-47116

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.

• CWE-918
• CWE-918

• https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64Patch
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0Release Notes
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8rExploit, Third Party Advisory
• https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64Patch
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0Release Notes
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8rExploit, Third Party Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47110blockreassurance adds an information block aimed at offering…5.3
• CVE-2023-47111ZITADEL provides identity infrastructure. ZITADEL provides a…3.7
• CVE-2023-47112Rundeck is an open source automation service with a web cons…4.3
• CVE-2023-47113BleachBit cleans files to free disk space and to maintain pr…7.3
• CVE-2023-47114Fides is an open-source privacy engineering platform for man…6.1
• CVE-2023-47115Label Studio is an a popular open source data labeling tool.…5.4
• CVE-2023-47117Label Studio is an open source data labeling tool. In all cu…7.5
• CVE-2023-47118ClickHouse® is an open-source column-oriented database manag…9.8
• CVE-2023-47119Discourse is an open source platform for community discussio…6.1
• CVE-2023-4712A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-47120Discourse is an open source platform for community discussio…7.5
• CVE-2023-47121Discourse is an open source platform for community discussio…9.8