Executive brief
Openpanel is a website analytics and monitoring platform. An unauthenticated attacker can exploit the site-checker endpoint to make arbitrary server-side HTTP requests to internal networks and cloud metadata services, potentially stealing sensitive credentials, discovering internal infrastructure, and scanning for open services. This vulnerability requires no authentication and can be exploited remotely over the network.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF, CWE-918) in the GET /tools/site-checker endpoint of apps/api/src/controllers/tools.controller.ts. The endpoint accepts a user-supplied url query parameter and passes it directly to fetchWithRedirects() without any IP address validation or SSRF protections. The vulnerable code makes unguarded HTTP requests via fetch(), follows up to 10 redirects, and performs additional reconnaissance (TCP connection timing, SSL certificate probing, robots.txt and sitemap fetching). The endpoint is registered in the public API scope with no authentication required and weak rate limiting. An unauthenticated remote attacker can access cloud metadata endpoints (e.g., AWS/GCP/Azure instance metadata at 169.254.169.254), probe internal services, perform port scanning via timing analysis, and leak internal IP addresses both directly and to third-party services. The vulnerability is patched in version 2.3.0.
Affected products
- Openpanel Openpanel before 2.3.0
Timeline
- 2026-08-20: disclosed
- 2026-09-04: patched: Fixed in version 2.3.0