Bypass for blind SSRF #281950 and #287496

Disclosed: 2020-05-24 14:18:34 By 7001 To infogram
Low
Vulnerability Details
Hello, when checking these 2 reports #281950 and #287496 i found that it can be bypassed using IPv6/IPv4 Address Embedding Steps to reproduce: 1-access this link https://infogram.com/api/web_resource/url?q=http://[0:0:0:0:0:ffff:127.0.0.1] POC: {F528736} Refrences: http://www.tcpipguide.com/free/t_IPv6IPv4AddressEmbedding.htm https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery ## Impact Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf.
Actions
View on HackerOne
Report Stats
  • Report ID: 642675
  • State: Closed
  • Substate: resolved
  • Upvotes: 25
Share this report