Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).

Openpanel versions before 2.3.0 contain an unauthenticated full-read Server-Side Request Forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint. The vulnerability exists in apps/api/src/controllers/tools.controller.ts, where a user-supplied URL query parameter is passed directly to fetchWithRedirects() without any SSRF or IP validation. An unauthenticated remote attacker can exploit this to access cloud instance metadata endpoints (e.g., AWS IMDSv1), probe internal services, scan internal network ports, and read returned content including status codes, page sizes, timing, and parsed HTML metadata. Additionally, the vulnerability allows leaking internal IP addresses via the getIPInfo() function to third-party services. No authentication is required to exploit this vulnerability, significantly increasing its risk. The issue is fixed in Openpanel version 2.3.0.