Loading HuntDB...

Bypass for blind SSRF #281950 and #287496

Low
I
Infogram
Submitted None
Reported by 7001

Vulnerability Details

Technical details and impact analysis

Server-Side Request Forgery (SSRF)
Hello, when checking these 2 reports #281950 and #287496 i found that it can be bypassed using IPv6/IPv4 Address Embedding Steps to reproduce: 1-access this link https://infogram.com/api/web_resource/url?q=http://[0:0:0:0:0:ffff:127.0.0.1] POC: {F528736} Refrences: http://www.tcpipguide.com/free/t_IPv6IPv4AddressEmbedding.htm https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery ## Impact Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Server-Side Request Forgery (SSRF)