A critical SSRF vulnerability in Plane 0.23.1 allows unauthenticated attackers to perform unauthorized requests, posing a risk of internal network reconnaissance.

This is an SSRF vulnerability found in the password recovery functionality. An unauthenticated attacker can manipulate the application to send requests to arbitrary internal or external destinations.

With a CVSS score of 9.1, this vulnerability allows attackers to bypass perimeter defenses and interact with internal services that are not exposed to the public. This can lead to the exposure of internal metadata, unauthorized access to internal APIs, or service disruption, significantly increasing the attack surface of the internal infrastructure.

Immediate Action: Update the Plane application to the latest secure version provided by the vendor.

Proactive Monitoring: Review web server and application logs for unusual outbound request patterns originating from the password recovery module.

Compensating Controls: Implement egress filtering on the server hosting the application to restrict unauthorized outbound connections to internal network segments.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (52211) and Packet Storm.

Given the existence of public exploit code, this vulnerability should be treated as a high-priority item for remediation. Organizations must update their Plane installation immediately and verify that no unauthorized requests have been made to internal resources.