वेबहूक के माध्यम से OpenProject इंस्टेंस पर ब्लाइंड (Blind) SSRF

The SSRF vulnerability in OpenProject arises from the SMTP test endpoint (POST /admin/settings/mail_notifications) accepting arbitrary host and port values. The endpoint exhibits measurable differences in response behavior based on whether the target IP exists and the port is open. An attacker can leverage these timing and error distinctions to perform internal reconnaissance, discovering internal hosts and services. While the CVSS score is LOW, the ability to map internal infrastructure can be a stepping stone for further attacks, potentially leading to privilege escalation or data exfiltration if other vulnerabilities are present. This is similar to SSRF vulnerabilities found in other web applications where internal services are exposed.

Organizations using OpenProject for project management, particularly those with internal services accessible from the web server, are at risk. Shared hosting environments where multiple OpenProject instances share the same server are also potentially vulnerable, as an attacker could exploit the SSRF to gain access to other services running on the same host.

• linux / server: Monitor OpenProject logs for unusual SMTP test requests with unexpected host and port combinations. Use journalctl -u openproject to filter for relevant log entries.

journalctl -u openproject | grep '/admin/settings/mail_notifications' | grep -v '127.0.0.1'

• generic web: Use curl to test the SMTP test endpoint with various internal IP addresses and ports to identify potential SSRF behavior.

curl -v --connect-timeout 1 http://<openproject_ip>/admin/settings/mail_notifications -d '[email protected]&smtp_host=192.168.1.100&smtp_port=8080'

1. 2026-03-11Disclosure

   disclosure

1. आरक्षित2026-03-10
2. प्रकाशित2026-03-11
3. संशोधित2026-03-12
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-31974 is to upgrade OpenProject to version 17.2.0 or later, which includes the fix for this SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /admin/settings/mail_notifications endpoint with arbitrary host and port values. Additionally, restrict access to the administrative settings panel to authorized users only. Regularly review OpenProject configurations to ensure adherence to security best practices.