CVE-2025-10695: Opensupports SSRF Vulnerability

CVE-2025-10695 Overview

CVE-2025-10695 is a Server-Side Request Forgery (SSRF) vulnerability in OpenSupports 4.11.0, an open-source customer support ticketing system. Two diagnostic endpoints are declared with permission => 'any', which exposes them to unauthenticated callers. Attackers can supply arbitrary destination URLs, causing the backend to initiate outbound network connections on their behalf. This behavior enables internal network reconnaissance, port scanning, and interaction with services that trust the OpenSupports host. The issue is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can pivot through the OpenSupports backend to scan internal networks and reach services otherwise unreachable from the internet.

Affected Products

OpenSupports 4.11.0
Deployments exposing OpenSupports diagnostic endpoints to untrusted networks
Any environment where OpenSupports shares network segments with sensitive internal services

Discovery Timeline

2025-10-03 - CVE-2025-10695 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10695

Vulnerability Analysis

OpenSupports 4.11.0 exposes two diagnostic endpoints intended to test outbound connectivity from the backend. Both endpoints register their route permission as permission => 'any', which bypasses authentication and authorization checks. A remote attacker submits a target URL or host through the endpoint parameters. The application then opens a connection from the server to the attacker-controlled destination. Because the request originates from the backend, it can reach cloud metadata services, internal APIs, and services bound to loopback or private ranges. Details are documented in the Fluid Attacks Security Advisory.

Root Cause

The root cause is missing access control on diagnostic routes combined with unvalidated user-supplied destinations. The permission => 'any' declaration removes the authentication gate that other administrative endpoints enforce. The endpoints also lack an allowlist restricting destination hosts, schemes, or ports. This combination transforms internal test utilities into a general-purpose SSRF primitive.

Attack Vector

Exploitation requires only network reachability to the OpenSupports HTTP interface. An attacker sends a crafted request to the vulnerable diagnostic endpoint with a destination pointing at an internal resource such as http://169.254.169.254/latest/meta-data/ on cloud deployments, http://127.0.0.1:6379 for Redis, or private RFC1918 ranges for lateral reconnaissance. The backend performs the outbound request and, depending on the endpoint, may return response metadata such as status codes or timing that allows the attacker to infer service presence. See the OpenSupports repository for endpoint definitions.

No verified public exploit code is available. Refer to the linked advisory for technical details.

Detection Methods for CVE-2025-10695

Indicators of Compromise

Unauthenticated HTTP requests to OpenSupports diagnostic endpoints containing URL, host, or port parameters referencing internal IP ranges.
Outbound connections from the OpenSupports application host toward 169.254.169.254, loopback ports, or RFC1918 addresses not part of normal operation.
Repeated diagnostic endpoint requests within short intervals, indicating scripted port scanning through the backend.

Detection Strategies

Enable web server access logging and alert on requests to diagnostic paths where the source is unauthenticated.
Correlate application logs with egress firewall logs to identify backend-initiated connections that do not match expected ticketing workflows.
Deploy web application firewall rules that inspect request parameters for internal IP literals, cloud metadata hostnames, and non-HTTP schemes.

Monitoring Recommendations

Monitor egress traffic from the OpenSupports host and baseline expected destinations, flagging deviations to internal ranges.
Track unusual response sizes or latencies on diagnostic endpoints that suggest interaction with slow internal services.
Ingest web, WAF, and network telemetry into a centralized analytics platform to reconstruct SSRF activity across layers.

How to Mitigate CVE-2025-10695

Immediate Actions Required

Restrict network access to OpenSupports diagnostic endpoints using upstream reverse proxy rules or firewall ACLs until a patched release is available.
Place the OpenSupports host in a segmented network with strict egress filtering that blocks access to cloud metadata endpoints and internal management interfaces.
Audit web server logs for prior invocations of the diagnostic endpoints and investigate any requests originating from untrusted sources.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the OpenSupports GitHub repository for security releases addressing CVE-2025-10695 and review the Fluid Attacks advisory for coordinated disclosure updates.

Workarounds

Block the vulnerable diagnostic routes at the reverse proxy or WAF layer for all unauthenticated clients.
Enforce an egress allowlist on the application host so the backend can only reach required external dependencies such as SMTP and update services.
If diagnostic functionality is not required, disable or remove the affected route handlers from the deployment.

bash

# Example nginx configuration to block unauthenticated diagnostic endpoints
location ~* ^/api/.*(system/test|diagnostic) {
    deny all;
    return 403;
}