What is perfSONAR?
perfSONAR is a network measurement toolkit that uses a component called pScheduler to manage and execute various types of performance tests. Users can schedule tests through either the command-line interface or the pScheduler API.
Arbitrary File Read Vulnerability – CVE-2022-45213
About the http Test Type
Among the supported test types in pScheduler is http, which is typically used to measure HTTP response times. Normally, this test connects to a specified URL and retrieves connection metadata without exposing the full HTTP response.
Exploiting the file: Scheme
It was discovered that the url parameter in the test specification also accepted a file-based scheme (such as file:/etc/passwd). While this did not directly return the contents of the file, the presence of a parse parameter allowed the system to search for specific keywords within the response.
By targeting a known local file and including a keyword to search for (such as “root”), it was possible to determine whether that string existed in the file. This effectively enabled arbitrary file read capabilities through crafted test payloads.
Server-Side Request Forgery (SSRF) – CVE-2022-45027
What is SSRF?
Server-Side Request Forgery (SSRF) occurs when a vulnerable server is tricked into sending network requests on behalf of the attacker—often to internal systems not otherwise accessible from outside the network.
How the SSRF Was Discovered
By manipulating the Host header in requests to pScheduler, researchers discovered they could coerce the server into making outbound requests to attacker-controlled domains. This confirmed an SSRF vulnerability in how pScheduler handled incoming task data.
The server returned an internal server error in response to these crafted requests, while external logging confirmed that a request was sent out by the vulnerable system.
Port Scanning via SSRF
Further analysis revealed that this SSRF vulnerability could be used to scan internal ports:
- When attempting to connect to a closed port, the system would return a “connection refused” error.
- When connecting to an open port, a different TLS-related error would appear.
- This behavioural difference allowed attackers to infer which internal ports were open or closed, enabling basic internal network reconnaissance.
Vulnerability Disclosure Timeline
- 4 November 2022 – Issues reported to the perfSONAR team. A fix was confirmed for an upcoming release.
- 9 November 2022 – perfSONAR version 4.4.6 was released, containing the fix.
- 9 December 2022 – CVE identifiers were reserved (CVE-2022-45213 and CVE-2022-45027).
- 31 January 2023 – A public blog post disclosed the findings.
