LY Corporation · Report #1131608
SSRF occurrence in website preview used by LINE Official Account Manager (https://manager.line.biz)
Validstatus
lowseverity
$100bounty
11upvotes
18 Apr 2022disclosed
Summary
LINE Official Account Manager (https://manager.line.biz) uses PagePoker to provide website previews. Here it was not properly validated against the Opengraph image tag target, which could point to an internal network resource.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.