Executive brief
Orion-ops is a server management tool that administrators use to test connectivity to remote machines via SSH. A flaw in the SSH connection testing feature fails to validate user input, allowing authenticated attackers to bypass intended access controls and coerce the server into connecting to arbitrary internal addresses. This enables network mapping and port discovery of internal infrastructure that should not be reachable from the attacker's location.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the MachineInfoController component, specifically in the SSH connection handler endpoints POST /orion/api/machine/direct-test-connect and POST /orion/api/machine/direct-test-ping. The root cause is missing input validation and missing role-based access controls on the endpoints; user-supplied parameters (host, sshPort, username, password, authType) are forwarded directly to MachineInfoServiceImpl.testConnect without validation against a whitelist of managed machines. An authenticated attacker can exploit this to initiate arbitrary TCP connections from the Orion-ops server to internal addresses, enabling network reconnaissance and port scanning. The attack requires an existing authenticated session but no special privileges. No official patch has been published as of the disclosure date.
Affected products
- OrionSec Orion-ops up to commit 5925824997a3109651bbde07460958a7be249ed1
Timeline
- 2025-12-01: disclosed
- other: Exploit published on GitHub; vendor contacted early but did not respond