CVE-2023-26735: 
NixOS vulnerability analysis and mitigation

The blackbox_exporter version 0.23.0 contains an access control vulnerability in its probe interface. This vulnerability (CVE-2023-26735) allows attackers to detect intranet ports and services, as well as download resources. However, it's important to note that this vulnerability is disputed by third parties because authentication can be configured (NVD, Debian).

The vulnerability has been classified with a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue is related to Server-Side Request Forgery (SSRF) vulnerability, identified as CWE-918 (NVD).

If exploited, the vulnerability could allow attackers to perform unauthorized detection of intranet ports and services, as well as download resources from the affected system. This could potentially lead to information disclosure and network mapping capabilities (NVD).

The primary mitigation is to properly configure authentication for the blackbox_exporter. The software supports TLS and basic authentication which can be configured using the --web.config.file parameter. This enables better control of the various HTTP endpoints (GitHub Docs).

The vulnerability has generated discussion within the open-source community, with multiple issue reports being created on GitHub. The project maintainers have disputed the severity of the vulnerability, noting that it can be mitigated through proper authentication configuration (GitHub Issues).