Loading HuntDB...

Issues with uploading list images

I
Instacart
Submitted None
Reported by cablej

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
Hi, There are several issues with uploading images for a list, i.e. with a PUT request to `https://www.instacart.com/api/v2/lists/153253` and passing `list[remote_image_url]`. First, information about open ports and SSH information can be disclosed via different urls. For example, PUT-ing localhost:80 will return a 404 error, but localhost:1010 will return a connection refused error. PUT-ing localhost:22 will, return `"Image could not download file: wrong status line: 'SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3'"`, showing that OpenSSH version 6.6.1p1 is being used, which is outdated and may be vulnerable to published exploits. Passing a value such as `http://google.com` will show that rmagick is being used, with an error: `"Image must be a JPEG or PNG","Image Failed to manipulate with rmagick, maybe it is not an image? Original Error: unable to open file `/tmp/magick-ezcF8DGU': No such file or directory @ error/constitute.c/ReadImage/583"` Finally, uploading a JPG such as in [https://hackerone.com/reports/390] makes the server timeout and returns a 502 error, overflowing the memory. I have attached the image below. Thanks for your time, and please let me know if you need any more information.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Uncontrolled Resource Consumption