Issues with uploading list images
I
Instacart
Submitted None
Actions:
Reported by
cablej
Vulnerability Details
Technical details and impact analysis
Hi,
There are several issues with uploading images for a list, i.e. with a PUT request to `https://www.instacart.com/api/v2/lists/153253` and passing `list[remote_image_url]`.
First, information about open ports and SSH information can be disclosed via different urls. For example, PUT-ing localhost:80 will return a 404 error, but localhost:1010 will return a connection refused error. PUT-ing localhost:22 will, return `"Image could not download file: wrong status line: 'SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3'"`, showing that OpenSSH version 6.6.1p1 is being used, which is outdated and may be vulnerable to published exploits.
Passing a value such as `http://google.com` will show that rmagick is being used, with an error: `"Image must be a JPEG or PNG","Image Failed to manipulate with rmagick, maybe it is not an image? Original Error: unable to open file `/tmp/magick-ezcF8DGU': No such file or directory @ error/constitute.c/ReadImage/583"`
Finally, uploading a JPG such as in [https://hackerone.com/reports/390] makes the server timeout and returns a 502 error, overflowing the memory. I have attached the image below.
Thanks for your time, and please let me know if you need any more information.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Uncontrolled Resource Consumption