CVE-2020-24881: osTicket SSRF allows file upload and port scanning

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references, and very high EPSS probability make this a critical exposure.

What it is

osTicket before 1.14.3 contains a server-side request forgery flaw. An attacker can use it to add a malicious file to the server or perform port scanning. The CVSS 3.1 base score is 9.8 (critical) with a network vector and no privileges or user interaction required.

Impact

An attacker can make the server issue requests on their behalf, enabling internal port scanning and placement of a malicious file on the server. This can expose internal services and potentially lead to further compromise.

Attack surface

Reachable over the network via the vulnerable osTicket component; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are needed. The description does not name the exact endpoint or parameter.

Exploitation

Not listed in CISA KEV, but EPSS 30-day probability is 0.73449 (99.44th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. No ransomware group is documented using it.

What to do

• Upgrade osTicket to 1.14.3 or later, applying the vendor patch commit d98c2d096aeb8876c6ab2f88317cd371d781f14d.
• Restrict outbound network access from the osTicket host to only required destinations.
• Place osTicket behind a reverse proxy or WAF that blocks requests to internal/private IP ranges.
• Disable or restrict any osTicket feature that fetches remote URLs if not required.
• Monitor the osTicket host for unexpected outbound connections and file writes.

Detection

• Alert on outbound connections from the osTicket server to private or loopback IP ranges.
• Review web server and application logs for requests containing internal IP addresses or unusual URL parameters.
• Monitor for unexpected new files written to the osTicket web directory.
• Correlate osTicket process activity with network scanning behavior toward internal hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.