5

First, let me summarize how the SSRF works:

1) You setup an SVG image with a reference to your server via xlink. Here's an example that works:

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="200" height="200"><image height="200" width="200" xlink:href="http://EXAMPLE_SERVER/" /></svg>

2) You upload the image as your profile picture

3) EXAMPLE_SERVER receives the following HTTP request from the server that the image is uploaded to:

GET / HTTP/1.0
Host: EXAMPLE_SERVER
Accept-Encoding: gzip

So all I have been able to confirm is that this is indeed SSRF, as the request is coming from the server, not from my client side. However I'm not very skilled in this area, and I don't understand how to actually exploit this.

So how do I use this to enumerate files or perform any actions that will actually make it a valid vulnerability? I do believe an is-image-present oracle could be set up, but the server I am testing doesn’t have any images on it, so this wouldn’t be a problem.

Improve this question
8
  • Is this second step originated by your browser or server ? Normally upload actions or HTML serving does not trigger that kind of links this why I am asking.
    – alnbhclyn
    Commented May 29, 2019 at 22:11
  • @alnbhclyn Not sure I understand exactly what you’re asking, but I mean the second step is clicking the upload button.
    – Jack
    Commented May 31, 2019 at 17:51
  • If this request (GET / HTTP/1.0) happened after your click (upload button), I believe application represents it at that page. If so, you can see that request at your network tab. Could you please check, are you able to see that request on your browsers network tab.
    – alnbhclyn
    Commented May 31, 2019 at 18:45
  • @alnbhclyn I checked and I cannot see that request in the network tab
    – Jack
    Commented May 31, 2019 at 22:42
  • perfect. Now you need to find a open port at that intranet and detect which wrappers are accepted file:///, dict://, sftp://, ldap://, tftp://, gopher:// (check application responses / response codes / etc.) and also I believe you need to test TARGET_IP:PORT without wrapper. This attack vector is basically works as our proxy, we are able to communicate with other services. If we can find out a elasticsearch instance we can send arbitrary requests. Let me know the progress if you would like to continue.
    – alnbhclyn
    Commented Jun 1, 2019 at 0:02

1 Answer 1

Reset to default
0

If you know/guess the server file system information then you can try loading local system image file by giving file path in

xlink:href="localPathOfImage"

As this is SVG file then you can try checking XXE, Billions Laugh attack etc

Improve this answer
1
  • 3
    Please don't check the billion laughs attack against production systems...
    – Conor Mancone
    Commented Nov 15, 2019 at 19:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .