CVE-2025-10695
📋 TL;DR
CVE-2025-10695 is a Server-Side Request Forgery (SSRF) vulnerability in OpenSupports that allows unauthenticated attackers to make arbitrary network requests from the vulnerable server. This enables internal network scanning and interaction with internal services. Only OpenSupports version 4.11.0 is affected.
💻 Affected Systems
- OpenSupports
📦 What is this software?
Opensupports by Opensupports
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other internal systems by exploiting vulnerable services reachable from the OpenSupports server.
Likely Case
Internal network reconnaissance, scanning for open ports/services, and potentially accessing internal APIs or services that don't require authentication.
If Mitigated
Limited to network scanning capabilities if internal services are properly secured with authentication and network segmentation.
🎯 Exploit Status
Exploitation requires no authentication and is straightforward via HTTP requests to the diagnostic endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.11.1 or later
Vendor Advisory: https://github.com/opensupports/opensupports
Restart Required: Yes
Instructions:
1. Backup your OpenSupports installation and database. 2. Download OpenSupports 4.11.1 or later from GitHub. 3. Replace the existing installation files with the new version. 4. Restart your web server. 5. Verify the fix by checking the version.
🔧 Temporary Workarounds
Block Diagnostic Endpoints
allUse web server configuration to block access to the vulnerable diagnostic endpoints
# For Apache: RewriteRule ^/diagnostic-endpoint - [F]
# For Nginx: location ~ ^/diagnostic-endpoint { return 403; }
Network Segmentation
linuxRestrict outbound network access from the OpenSupports server
# Use firewall rules to limit outbound connections
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit the OpenSupports server's outbound network access
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running OpenSupports 4.11.0 by examining version files or admin panel. Test access to diagnostic endpoints without authentication.Check Version:
Check the version.php file or admin panel. For CLI: grep -r '4.11.0' /path/to/opensupports/Verify Fix Applied:
Verify version is 4.11.1 or later. Test that diagnostic endpoints now require authentication or return 403/404 errors.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to diagnostic endpoints from external IPs
- Multiple failed authentication attempts followed by diagnostic endpoint access
Network Indicators:
- Outbound connections from OpenSupports server to internal IP ranges
- Port scanning patterns originating from the OpenSupports server
SIEM Query:
source="web_server_logs" AND (uri="/diagnostic-endpoint" OR uri="/api/diagnostic") AND status="200"