Description

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-04T12:17:24.993Z",
  "pubdate": "2026-09-04T12:17:24.993Z",
  "executiveSummary": "OpenPanel versions prior to 2.3.0 are susceptible to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability located within the GET /tools/site-checker endpoint.\nThe vulnerability arises from the application's failure to sanitize or validate user-supplied URL parameters, allowing an unauthenticated remote attacker to force the server to initiate arbitrary HTTP requests.\nThis flaw enables attackers to interact with internal network resources that are otherwise inaccessible from the public internet, including localhost services, private IP ranges, and cloud provider metadata services.\nSuccessful exploitation allows for the exfiltration of sensitive information, such as HTTP response headers, status codes, and SSL certificate metadata.\nThe risk is critical as it grants attackers a mechanism to perform internal reconnaissance and potentially leverage the server as a pivot point for further network penetration.\nNo authentication or specific privileges are required to exploit this endpoint, as it is exposed to unauthenticated users.",
  "technicalDetails": "The vulnerability resides in the GET /tools/site-checker endpoint, which is designed to perform remote site connectivity checks. The application accepts a fully client-controlled URL parameter without implementing adequate validation, allow-listing, or block-listing mechanisms.\nThe root cause is a lack of server-side input sanitization regarding the target URL. The server processes the user-supplied input as a legitimate request destination, failing to implement protection against DNS rebinding or private IP address resolution (e.g., 127.0.0.1, 169.254.169.254, or RFC 1918 addresses).\nExploitation follows a simple, unauthenticated attack flow. An attacker constructs an HTTP GET request to the site-checker endpoint, supplying a target internal URL via the vulnerable parameter. Upon receipt, the OpenPanel server executes an outbound network request to the specified target. Because the request originates from the server itself, it bypasses network-level firewalls and security groups protecting internal segments.\nThe response returned by the internal target—including server titles, HTTP headers, status codes, and SSL certificate details—is subsequently processed and disclosed to the attacker. This allows for the enumeration of internal infrastructure, identifying active internal services, and potentially triggering actions on administrative interfaces that rely on IP-based authentication.\nThe impact is significant in cloud environments where the 169.254.169.254 metadata service may be accessible. By querying this endpoint, an attacker could potentially retrieve sensitive configuration data, identity tokens, or infrastructure credentials, leading to a full compromise of the cloud instance's identity. Furthermore, the ability to probe localhost allows an attacker to identify and potentially exploit internal services listening on loopback interfaces, such as databases or management APIs that do not require external authentication because they are assumed to be safe behind the perimeter.\nThis vulnerability is present in all versions of OpenPanel prior to 2.3.0 and requires no user interaction or elevated privileges, making it a high-utility target for automated reconnaissance and exploitation frameworks."
}