0

I am currently studying regarding SSRF. I noticed that an injection vector where SSRF might be present is always parameters that is related to url (Importing image using URL, others). I have encountered a couple of endpoints where request body contains url which is used to import image from the webserver. Something like this:

...&imageUrl=https://companyX.com/image/3123123

I was able to change the imageURL into my own url and upload my own image from my own web server. Is this normally considered as a vulnerability? Or is this just an indicator that a SSRF might be present?

Improve this question

1 Answer 1

Reset to default
1

Many websites implement the ability to fetch remote resources that are requested by a user. The presence of this feature alone does not automatically imply that a vulnerability exists. However, it is easy to implement this type of feature insecurely, so it may be worth looking into it during a test.

While you seem to be able to change the URL to your own server, there doesn't seem to be much impact to that (it's not clear from the question alone whether the image is actually downloaded by the server or just used on the frontend). SSRF typically has the most impact when it can be used to hit services that are not normally publicly available, so you would likely need to abuse SSRF for this purpose in order to have it considered an impactful vulnerability.

Improve this answer
2
  • Thank you for the answer. So what you're saying is that being able to upload my own image from my own server is not a security threat right? In order to fully exploit ssrf, the vulnerable endpoint needs to be able to make a connection to an external/internal endpoint.
    – Emanuel Beni
    Sep 7, 2020 at 5:51
  • @EmanuelBeni generally yes, but if the image is processed or used in another way, there could be an issue there as well. Hard to know without seeing the application.
    – multithr3at3d
    Sep 7, 2020 at 12:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .