Openpanel versions prior to 2.3.0 contain an unauthenticated SSRF in the GET /tools/site-checker endpoint. The endpoint accepts a user‑supplied URL parameter and forwards it to fetchWithRedirects() without performing any SSRF or IP validation. An attacker can therefore trigger server‑side HTTP requests to arbitrary URLs, including cloud‑metadata services, internal network resources, and external third‑party services. The response data—including status code, page size, timing, parsed HTML metadata, and third‑party IP leak via getIPInfo()—is returned to the attacker, providing visibility into internal infrastructure.

All instances of Openpanel built before version 2.3.0, as identified by the vendor Openpanel‑dev, are affected. This includes all releases where the site‑checker endpoint was active. No specific sub‑version breakdown is given, so any deployment older than 2.3.0 should be considered vulnerable.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely and without authentication by sending a crafted GET request to /tools/site-checker with an arbitrary URL. Successful exploitation allows an attacker to enumerate internal services, access cloud instance metadata, probe private networks, and leak internal IP addresses to external third‑party services. Provided the application runs with internet access, the risk of internal reconnaissance is significant.