CVE-2023-38059

What it actually does

The vulnerability allows bypassing of configured external image loading restrictions via protocol-relative URLs (e.g., //attacker.example/img), causing the client browser to fetch the resource and leak the user's IP address to the attacker.

Why it matters to the business

Attackers can discover real IP addresses of users or agents interacting with the ticketing system, supporting reconnaissance or targeted follow-on activity with limited but privacy-related exposure across customer support workflows.

How an attack unfolds

An attacker crafts content such as a ticket or article containing a protocol-relative image URL pointing to a server under their control. When a user or agent views the item, the browser resolves and requests the image directly from the attacker's host, logging the client's IP address in the attacker's access logs.

How to fix it

Upgrade OTRS to 7.0.47 or later and 8.0.37 or later; for Community Edition move past 6.0.34. Review and harden image loading configuration to reject or rewrite protocol-relative and external URLs until patches are applied.

How to confirm the fix worked

After upgrade, test by creating content with a protocol-relative image URL and confirm the request is blocked or rewritten; review release notes for input validation changes and scan configuration files for external image allow-lists.

Typical attack path

1. Identify a user-accessible content field that renders images
2. Insert a payload using a protocol-relative external image URL
3. Deliver the content to the target via ticket, notification, or knowledge base
4. Monitor attacker-controlled server logs for incoming image requests revealing victim IPs

How to detect it

Inspect web server or application logs for image requests containing protocol-relative patterns or unexpected external domains; correlate user session activity with outbound connections to unknown hosts when viewing tickets or articles.

What your security team should do

• Apply vendor patches to reach 7.0.47 / 8.0.37 or newer immediately
• Temporarily disable external image loading if the feature is non-essential
• Audit recent tickets and articles for suspicious image URLs
• Update incident response playbooks to treat unexpected IP disclosure as a potential reconnaissance indicator