Bypass for blind SSRF #281950 and #287496
Low
I
Infogram
Submitted None
Actions:
Reported by
7001
Vulnerability Details
Technical details and impact analysis
Hello,
when checking these 2 reports #281950 and #287496 i found that it can be bypassed using IPv6/IPv4 Address Embedding
Steps to reproduce:
1-access this link https://infogram.com/api/web_resource/url?q=http://[0:0:0:0:0:ffff:127.0.0.1]
POC:
{F528736}
Refrences:
http://www.tcpipguide.com/free/t_IPv6IPv4AddressEmbedding.htm
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery
## Impact
Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Server-Side Request Forgery (SSRF)