Issues with uploading list images
Unknown
Vulnerability Details
Hi,
There are several issues with uploading images for a list, i.e. with a PUT request to `https://www.instacart.com/api/v2/lists/153253` and passing `list[remote_image_url]`.
First, information about open ports and SSH information can be disclosed via different urls. For example, PUT-ing localhost:80 will return a 404 error, but localhost:1010 will return a connection refused error. PUT-ing localhost:22 will, return `"Image could not download file: wrong status line: 'SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3'"`, showing that OpenSSH version 6.6.1p1 is being used, which is outdated and may be vulnerable to published exploits.
Passing a value such as `http://google.com` will show that rmagick is being used, with an error: `"Image must be a JPEG or PNG","Image Failed to manipulate with rmagick, maybe it is not an image? Original Error: unable to open file `/tmp/magick-ezcF8DGU': No such file or directory @ error/constitute.c/ReadImage/583"`
Finally, uploading a JPG such as in [https://hackerone.com/reports/390] makes the server timeout and returns a 502 error, overflowing the memory. I have attached the image below.
Thanks for your time, and please let me know if you need any more information.
Actions
View on HackerOneReport Stats
- Report ID: 159820
- State: Closed
- Substate: resolved
- Upvotes: 11