Description
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | REMS | ≤ 1.0.0 | — |
References
- https://gist.github.com/neelkotnis/3c4a44d71e8f08747fbac13b2be87427 technical-description exploit
- REMS by OpsTree Product Page product
- VulnCheck Advisory: OpsTree REMS through 1.0.0 SSRF via Database Test Connection third-party-advisory