An unauthenticated server-side request forgery vulnerability in OpenPanel versions prior to 2.3.0 poses a high risk by enabling attackers to access internal network services and cloud metadata.

This is a Server-Side Request Forgery (CWE-918) vulnerability located in the GET /tools/site-checker endpoint. The application fails to perform necessary validation on user-supplied URL parameters, allowing unauthenticated remote attackers to force the server to issue requests to internal services, localhost, or cloud metadata endpoints.

The ability to perform SSRF allows an attacker to bypass perimeter security and interact with internal-only services that are not exposed to the public internet. This can lead to the unauthorized disclosure of sensitive configuration data, internal headers, and system status information, potentially facilitating further lateral movement within the network. With a CVSS score of 8.6, this vulnerability is classified as High, reflecting the significant potential for information disclosure and unauthorized internal access.

Immediate Action: Upgrade OpenPanel to version 2.3.0 or later, which contains the necessary security fixes to remediate this vulnerability.

Proactive Monitoring: Monitor server access logs for suspicious requests to the /tools/site-checker endpoint, specifically looking for attempts to access internal IP addresses or reserved loopback addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests to the site-checker endpoint that contain suspicious URL patterns or internal network references.

Public Exploit Available: No (exploit_available is false).

This vulnerability represents a critical security oversight in the OpenPanel software that could allow an attacker to gain unauthorized visibility into your private infrastructure. Organizations running OpenPanel should prioritize the upgrade to version 2.3.0 immediately. If an immediate patch is not feasible, restrict network access to the affected endpoint or disable the site-checker functionality until the update can be applied.