Plane allows server side request forgery via /_next/image endpoint

The SSRF vulnerability in Plane arises from improper handling of wildcard characters in image retrieval within the /web/next.config.js file. An attacker can craft a malicious URL containing wildcards, tricking the Plane server into sending requests to unintended destinations. This could include internal services not meant to be publicly accessible, cloud metadata endpoints (e.g., AWS IMDS), or even external websites controlled by the attacker. Successful exploitation could lead to information disclosure, privilege escalation, or even remote code execution if the targeted internal service is vulnerable. The blast radius extends to any internal resources accessible from the Plane server.

Organizations using Plane for project management, particularly those with sensitive internal resources or cloud infrastructure, are at risk. Shared hosting environments where Plane is deployed alongside other applications are also vulnerable, as a compromised Plane instance could be used to pivot to other tenants. Legacy Plane deployments running older, unpatched versions are especially susceptible.

• generic web: Use curl to test for SSRF by attempting to access internal services or cloud metadata endpoints through the Plane application.

curl http://localhost:3000/web/next.config.js?image=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin

• linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/nginx/access.log) for outbound requests to unusual or unexpected destinations originating from the Plane application's process. Use ss or lsof to identify network connections established by the Plane process.

ss -t tcp -p | grep plane
lsof -i -p $(pidof plane)

• generic web: Examine access and error logs for patterns indicative of SSRF attempts, such as requests to internal IP addresses or cloud metadata endpoints. Look for unusual HTTP status codes (e.g., 403 Forbidden) when attempting to access restricted resources.

1. 2024-10-11Disclosure

   disclosure

2. 2024-10-11Patch

   patch

1. आरक्षित2024-10-03
2. प्रकाशित2024-10-11
3. संशोधित2024-10-15
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-47830 is to immediately upgrade Plane to version 0.23.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy with strict outbound request filtering rules to block requests to suspicious domains or IP addresses. Carefully review and restrict any outbound network access granted to the Plane application. Monitor Plane logs for unusual outbound requests that may indicate exploitation attempts. After upgrading, confirm the fix by attempting to access an internal resource via a crafted URL; the request should be blocked or denied.