Description

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 86f370c9c20074c3c3fdec53a359874b8e670fd4. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-12T23:17:01.073Z",
  "pubdate": "2026-09-12T23:17:01.073Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in openstatusHQ openstatus, specifically within the custom domain rewrite proxy functionality. This vulnerability allows an unauthenticated, remote attacker to coerce the server into making unauthorized HTTP requests to arbitrary destinations. By manipulating the target URL processed by the proxy, an attacker can bypass network perimeters, potentially interacting with internal services or restricted metadata endpoints not intended for public access. The vulnerability poses a significant risk to the integrity and confidentiality of the host environment. The flaw is rooted in insufficient validation of input parameters used to construct proxied requests within the affected codebase. Organizations utilizing openstatus are exposed to this risk unless the identified patch is applied. Given the nature of the proxy utility, successful exploitation grants the attacker the ability to pivot through the application server to perform internal network reconnaissance or initiate unauthorized requests against internal infrastructure, effectively bypassing access control mechanisms.",
  "technicalDetails": "The vulnerability resides in apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts, which handles the resolution and redirection logic for custom domain requests. The root cause is the lack of robust sanitization and strict validation of host or URL parameters provided during the proxy rewrite phase. When a request is processed, the application constructs a secondary request based on user-supplied input without verifying if the target domain or IP address is permitted or internal.\nThe attack flow initiates when a remote, unauthenticated attacker crafts a request to the affected proxy endpoint, injecting a malicious URL into the parameters expected by the resolve-custom-domain-rewrite.ts component. Because the application logic trusts the input during the rewrite process, it initiates an outbound request from the server hosting openstatus to the attacker-specified destination. This effectively turns the application server into a proxy for the attacker.\nThis SSRF vector allows for the exploitation of internal network boundaries. An attacker may perform reconnaissance by scanning internal IP ranges, targeting internal-only APIs, or accessing cloud provider metadata services (e.g., http://169.254.169.254/) to exfiltrate sensitive configuration data, service account tokens, or environment-specific credentials. Since the server performs the request on behalf of the application, it bypasses traditional firewall or Network Security Group (NSG) restrictions that otherwise prevent external traffic from reaching internal segments.\nThe vulnerability affects openstatus up to commit f04c827112f30a11d571ebdad3892826034d6265. Authentication is not required for the triggering of this vulnerability, and the attack can be fully initiated from remote network locations. The post-exploitation impact includes unauthorized data exfiltration, lateral movement within the private network, and potentially the degradation of service or unauthorized state changes on internal applications that trust traffic originating from the local host or application environment. The vulnerability is resolved by the patch identified as 86f370c9c20074c3c3fdec53a359874b8e670fd4, which presumably introduces validation logic to restrict the set of permissible hostnames or prevents the proxy from resolving private/non-routable IP address spaces."
}