SSRF with filter bypass via open redirection vulnerability | Dec 24, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: SSRF with filter bypass via open redirection vulnerability! Without further ado, let’s dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab has a stock check feature which fetches data from an internal system.

To solve the lab, change the stock check URL to access the admin interface at http://192.168.0.12:8080/admin and delete the user carlos.

The stock checker has been restricted to only access the local application, so you will need to find an open redirect affecting the application first.

Exploitation

Home page:

In the previous labs, we found that the stock check feature is vulnerable to Server-Side Request Forgery(SSRF).

This time however, we couldn’t supply our own domain:

URL decoded:

/product/stock/check?productId=1&storeId=1

Let’s take a step back.

In the product page, we also can see a New product link:

Hmm… The path parameter might vulnerable to open redirect!

Let’s test it:

It indeed redirect me to my website! Can confirm it’s vulnerable to open redirect.

Let’s chain those vulnerabilities: Open redirect -> SSRF

Payload:

/product/nextProduct?currentProductId=1&path=http://192.168.0.12:8080/admin

Nice! Let’s delete user carlos:

We did it!

What we’ve learned:

SSRF with filter bypass via open redirection vulnerability