CVE-2024-47830: SSRF in Plane Project Management Tool

The SSRF vulnerability in Plane arises from improper handling of wildcard characters in image retrieval within the /web/next.config.js file. An attacker can craft a malicious URL containing wildcards, tricking the Plane server into sending requests to unintended destinations. This could include internal services not meant to be publicly accessible, cloud metadata endpoints (e.g., AWS IMDS), or even external websites controlled by the attacker. Successful exploitation could lead to information disclosure, privilege escalation, or even remote code execution if the targeted internal service is vulnerable. The blast radius extends to any internal resources accessible from the Plane server.

1. Reserved2024-10-03
2. Published2024-10-11
3. Modified2024-10-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-47830 is to immediately upgrade Plane to version 0.23.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy with strict outbound request filtering rules to block requests to suspicious domains or IP addresses. Carefully review and restrict any outbound network access granted to the Plane application. Monitor Plane logs for unusual outbound requests that may indicate exploitation attempts. After upgrading, confirm the fix by attempting to access an internal resource via a crafted URL; the request should be blocked or denied.