Description
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction.
This issue affects OpenSupports: 4.11.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSupports | OpenSupports | 4.11.0 | — |
References
- https://fluidattacks.com/advisories/freer third-party-advisory
- https://github.com/opensupports/opensupports product