CVE-2023-50913

Executive Summary

CVE-2023-50913 is a Server-Side Request Forgery (SSRF) vulnerability in Oxide control plane software prior to version 5. This flaw allows an attacker to make unauthorized requests from the server, potentially accessing internal resources, cloud metadata endpoints, or other sensitive systems that are not intended to be exposed. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the underlying SSRF risk is significant in cloud-native environments. No public exploit code or proof-of-concept is currently available, and no patch details have been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the Oxide control plane, which is a core component of Oxide’s cloud infrastructure platform. Since Oxide is a hardware/software vendor for on-premise cloud deployments, the supply chain risk is moderate. Organizations using Oxide control plane software should verify their version and apply any vendor-provided updates immediately. No open-source package (NPM, PyPI, Go, Ruby) is directly associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network (likely)
• Attack Complexity: Low (typical for SSRF)
• Privileges Required: None (likely)
• User Interaction: None (likely)
• Scope: Changed (SSRF can pivot to internal networks)
• Confidentiality Impact: High (access to internal metadata)
• Integrity Impact: Low (potential to modify internal state)
• Availability Impact: Low (unlikely to cause denial of service)

Threat Level: High (due to potential for internal network reconnaissance and cloud metadata exfiltration)

Deep Dive & Mechanics

The vulnerability resides in the Oxide control plane software, which manages the lifecycle of Oxide compute nodes and infrastructure. The SSRF flaw likely occurs in an HTTP client or proxy component that does not properly validate user-supplied URLs or redirects. An attacker can craft a request that forces the server to make a request to an arbitrary internal or external address.

Attack Scenario:

1. The attacker sends a specially crafted HTTP request to the Oxide control plane API.
2. The control plane processes the request and makes an outbound HTTP request to a URL controlled by the attacker or to an internal resource (e.g., http://169.254.169.254/latest/meta-data/).
3. The response from the internal resource is returned to the attacker, leaking sensitive data such as cloud provider credentials, internal network topology, or configuration secrets.

Root Cause: Insufficient validation of user-supplied URLs in the control plane’s HTTP client, allowing arbitrary host/port combinations.

Vulnerable vs. Patched Code

Since no patch details are available, we can only hypothesize the fix. The vulnerable code likely resembles:

# Vulnerable code (hypothetical)
def fetch_url(user_url):
    response = requests.get(user_url)  # No validation
    return response.text

The patched version would include URL validation:

# Patched code (hypothetical)
from urllib.parse import urlparse

ALLOWED_HOSTS = ['api.oxide.internal', 'metadata.oxide.internal']

def fetch_url(user_url):
    parsed = urlparse(user_url)
    if parsed.hostname not in ALLOWED_HOSTS:
        raise ValueError("URL not allowed")
    response = requests.get(user_url)
    return response.text

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Oxide control plane API endpoint (version < 5).
• Ability to send HTTP requests to the control plane.

Exploitation Steps:

1. Identify an API endpoint that accepts a URL parameter (e.g., /api/v1/proxy?url=).
2. Craft a request to fetch cloud metadata:

   GET /api/v1/proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
   Host: oxide-control-plane.example.com
   

3. If successful, the response will contain cloud metadata (e.g., AWS credentials, instance ID).
4. Use the leaked credentials to pivot deeper into the cloud environment.

Lab Setup:

• Deploy a vulnerable Oxide control plane (version 4.x) in a controlled environment.
• Set up a simple HTTP server to simulate internal resources.
• Use curl or Burp Suite to send malicious requests.

Blue Team

Detection:

• Monitor outbound HTTP requests from the control plane to unexpected IPs (especially 169.254.169.254, 10.x.x.x, 172.16.x.x, 192.168.x.x).
• Alert on API calls that include URL parameters with internal IPs or unusual hostnames.
• Use network segmentation to limit the control plane’s ability to reach internal resources.

Mitigation:

• Apply vendor patch immediately when available.
• Implement strict URL allowlisting in the control plane’s HTTP client.
• Deploy a web application firewall (WAF) to block SSRF patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (cloud metadata IP)
  • Outbound HTTP requests to internal RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Unusual Host headers in API requests (e.g., Host: metadata.google.internal)
• File IOCs:
  • Log entries containing url=http:// or url=https:// with internal IPs
• Behavioral IOCs:
  • Multiple failed requests to internal resources from the control plane
  • Sudden increase in outbound HTTP traffic from the control plane

Detection Engineering

YARA Rule

rule CVE_2023_50913_SSRF_Oxide {
    meta:
        description = "Detects SSRF attempts targeting Oxide control plane"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50913"
    strings:
        $url_pattern = /url=http:\/\/(169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $metadata = "latest/meta-data" nocase
        $internal_host = "metadata.google.internal" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-50913 Oxide Control Plane SSRF Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SSRF attempts against Oxide control plane by monitoring outbound HTTP requests to internal IPs.
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_ip:
            - '169.254.169.254'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
        app_protocol: 'http'
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-50913 Oxide Control Plane SSRF Attempt"; flow:to_server; content:"url=http://"; nocase; pcre:"/url=http:\/\/(169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate the Oxide control plane from internal networks if possible.
   • Implement network access controls to block outbound requests to cloud metadata IPs and internal RFC 1918 addresses.
   • Monitor logs for SSRF patterns.

2. Vendor Patch:

   • Contact Oxide support for patch details. Upgrade to version 5 or later as soon as available.

3. Long-term Fixes:

   • Implement strict URL validation in the control plane’s HTTP client (allowlist approach).
   • Use a dedicated proxy for outbound requests with URL filtering.
   • Conduct regular security audits of API endpoints.

4. Compensating Controls:

   • Deploy a WAF with SSRF protection rules.
   • Use network segmentation to limit the blast radius of SSRF attacks.

Valters IT