Description

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T12:17:24.317Z",
  "pubdate": "2026-09-04T12:17:24.317Z",
  "executiveSummary": "Openpanel versions prior to 2.3.0 are susceptible to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The flaw exists within the /tools/site-checker endpoint, which improperly handles user-supplied input.\nThis vulnerability allows an unauthenticated remote attacker to force the server to perform arbitrary HTTP requests to internal or external network resources. By exploiting this, an adversary can bypass firewall restrictions to probe internal infrastructure, interact with cloud provider instance metadata services, and conduct port scanning on private network segments.\nThe risk is critical due to the lack of input validation and the ability for an attacker to obtain sensitive data, such as internal IP addresses or internal service responses, without authentication. This effectively turns the affected server into a proxy for malicious activity, potentially exposing internal configuration details, cloud environment secrets, or private network topology to unauthorized entities.\nSuccessful exploitation requires no specialized privileges, as the endpoint is accessible without authentication. The impact ranges from information disclosure to potential service disruption and further exploitation of internal-only network services.",
  "technicalDetails": "The vulnerability resides in the apps/api/src/controllers/tools.controller.ts file, specifically within the logic governing the GET /tools/site-checker endpoint. The root cause is the improper validation of the user-supplied 'url' query parameter before passing it to the fetchWithRedirects() internal function.\nBecause the application fails to implement any allowlisting or IP/domain validation, the server processes the user-provided URL as a legitimate destination for an outgoing HTTP request. The lack of restriction allows attackers to direct requests toward sensitive local interfaces, such as 127.0.0.1, or cloud metadata endpoints (e.g., 169.254.169.254), which are typically protected by the host's perimeter defenses.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a request targeting the /tools/site-checker endpoint, supplying a target URL in the 'url' parameter. Second, the controller passes this input directly to fetchWithRedirects(), which initiates a server-side HTTP request to the specified resource. Third, the application processes the response from the target destination and returns information such as HTTP status codes, page size, response timing, and parsed HTML metadata back to the attacker.\nThis behavior facilitates several post-exploitation actions. Attackers can perform internal network reconnaissance by observing response variances to scan for open ports or active services behind the firewall. Furthermore, the vulnerability triggers getIPInfo() to a third-party, which facilitates the leakage of internal server IP addresses. The ability to read content allows for the exfiltration of sensitive HTML headers or body data from internal services that rely on network-level trust for authorization.\nThe flaw affects all Openpanel versions prior to 2.3.0. Since the endpoint does not enforce authentication, it exposes the underlying server infrastructure to any network-reachable entity. The absence of an egress filtering policy or request validation makes the service a highly effective tool for an attacker to gain visibility into the internal server architecture and environment."
}