A critical server-side request forgery vulnerability in OpenHarness allows unauthenticated attackers to access sensitive internal network services and cloud metadata endpoints.

This is a server-side request forgery (SSRF) flaw (CWE-918) present in the web_fetch and web_search tools. It allows an unauthenticated attacker to manipulate tool parameters to send HTTP requests to loopback addresses, RFC1918 internal networks, and cloud metadata services.

The ability to perform SSRF against internal and local services poses a significant risk to organizational security. Attackers can bypass network perimeters to interact with non-public admin panels, internal development services, or sensitive cloud metadata endpoints, potentially leading to information disclosure or further lateral movement. With a CVSS score of 8.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized access to internal resources.

Immediate Action: Update your OpenHarness installation to commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae or later to ensure the proper validation of target addresses.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the OpenHarness service, specifically targeting internal IP ranges or local hostnames.

Compensating Controls: Implement strict egress filtering on the host running OpenHarness to prevent the service from reaching internal network segments or unauthorized metadata service endpoints.

Public Exploit Available: Unknown

Given the capability for unauthenticated attackers to reach internal infrastructure, this vulnerability represents a high risk to the confidentiality and integrity of your network environment. Security teams must prioritize the application of the provided fix to block the SSRF vector. If patching is not immediately feasible, ensure that network-level restrictions are in place to isolate the affected service from sensitive internal segments.