CVE-2020-24881

published 2020-11-02

CVE-2020-24881: SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

Priority P2 75 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
osticket	osticket	< 1.14.3	1.14.3

Detection & IOCs extracted from sources · hover to see the quote

url /open.php

url /ajax.php/form/help-topic/{{option_value}}

url /tickets.php?a=print&id={{ticketid}}

• → Detect SSRF exploitation attempt: monitor for POST requests to /open.php with multipart/form-data containing a crafted 'message' field, followed by a GET to /tickets.php?a=print — the print action triggers the server-side request to attacker-controlled URLs embedded in the ticket message.
• → Monitor for outbound DNS/HTTP requests from the osTicket server process triggered by the print ticket action — indicative of SSRF payload delivery via the ticket message body.
• → Alert on requests to /tickets.php with query parameter a=print, especially when the originating ticket was recently created via /open.php with an external URL in the message field.

• · Vulnerability affects osTicket versions before 1.14.3 only; upgrade to 1.14.3+ to remediate. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918