Description

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T12:17:24.727Z",
  "pubdate": "2026-09-04T12:17:24.727Z",
  "executiveSummary": "OpenPanel versions prior to 2.3.0 are affected by an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This security flaw originates from improper input validation within the /misc/favicon and /misc/og endpoints, which accept user-supplied URL parameters. An unauthenticated attacker can exploit this vulnerability to force the server to initiate arbitrary HTTP requests to internal network resources or cloud provider metadata services. Successful exploitation permits an attacker to perform internal service enumeration, bypass network firewalls, and extract sensitive data—including cloud environment credentials—returned in the server's response. The risk level is critical, as it requires no prior authentication and provides a pathway for further infrastructure compromise, lateral movement, or unauthorized information disclosure.",
  "technicalDetails": "The vulnerability resides in the application's processing of the 'url' parameter provided to the /misc/favicon and /misc/og endpoints. These endpoints are designed to fetch remote resources, such as website favicons or Open Graph metadata, to display them within the OpenPanel interface. However, the implementation lacks robust server-side validation or a strictly enforced allow-list for the requested hostnames.\nThe root cause is an insufficient sanitization of the user-controlled input, which allows for the injection of arbitrary URIs. By manipulating the 'url' parameter, an attacker can coerce the underlying server infrastructure to make outbound GET requests to internal-only endpoints. This bypasses the security boundary between the public internet and the internal management network.\nThe attack flow begins when an attacker sends a malicious HTTP request to the vulnerable endpoint with a crafted 'url' value targeting an internal IP address or the local metadata service (e.g., 169.254.169.254 for cloud environments). Because the server performs the request on behalf of the application, it effectively acts as a proxy for the attacker. If the requested target returns a response, the application transmits the body of that response back to the attacker, provided it falls within the expected payload size limitations.\nThis vulnerability is particularly dangerous in cloud-hosted environments. If the server is running on a cloud instance, an attacker can request sensitive metadata, such as IAM roles, temporary security credentials, or configuration details, by querying the instance metadata service. Furthermore, an attacker can map the internal network topology by probing various ports and hostnames that are unreachable from the public internet. This process of internal service enumeration allows the attacker to identify internal services, hidden administrative interfaces, or unprotected databases that may be susceptible to further exploitation.\nThe vulnerability is present in all versions of OpenPanel prior to 2.3.0. Exploitation does not require authentication, and the attack can be executed from any network location that can reach the public-facing HTTP interface of the OpenPanel installation. Post-exploitation, the impact ranges from sensitive data exfiltration to facilitating further network-based attacks by leveraging the server's trusted position within the internal perimeter."
}