SSRF with filter bypass via open redirection vulnerability
This lab has a stock check feature which fetches data from an internal system.
Reproduction and proof of concept
Visit a product, click Check stock, intercept the request in Burp Suite, and send it to Burp Repeater. Click next product (on the site) and send that to Repeater also.
Try tampering with the
stockApiparameter of the first intercepted request and observe that it isn’t possible to make the server issue the request directly to a different host.
For the next product request observe that the
pathparameter is placed into the
Locationheader of a redirection response, resulting in an open redirection.
Create a URL that exploits the open redirection vulnerability, and redirects to the
admininterface, and feed this into the
stockApiparameter on the stock checker:
Observe that the stock checker follows the redirection and shows you the admin page.
Amend the path to delete the target user:
An attacker will need to change the stock check URL to access the admin interface at
http://192.168.0.12:8080/admin and delete the user
carlos. The stock checker has been restricted to only access the local application, so the attacker will need to find an open redirect affecting the application first.