CVE-2022-41412

perfSONAR's graphData.cgi component lets an attacker reach sensitive data and, more importantly, drive server-side request forgery, unauthenticated and over the network. The scope-changed metric is the tell: the SSRF lets the perfSONAR host make requests to systems beyond itself, so the affected blast radius extends past the vulnerable component into whatever internal services it can touch.

perfSONAR is network-measurement software that lives on research, education, and backbone networks, often on well-connected hosts with broad internal reach, which is precisely what makes an SSRF here valuable. An attacker uses it to enumerate and hit internal infrastructure and metadata services from a trusted vantage point. It is confidentiality-oriented rather than a direct takeover, but as a pivot it can be the opening move of a deeper intrusion.

The determining factor for us is reachability, both inbound and outbound. We want to know which perfSONAR nodes expose graphData.cgi to untrusted networks and, just as critically, what those nodes can reach internally, because tightening egress and segmenting the measurement hosts limits the SSRF's usefulness even before the component is fixed. Exposure mapping is where this one gets prioritized up or down.