RelateIQ · Report #16571
SSRF (Portscan) via Register Function (Custom Server)
How it was found
Hi,
the custom server option during registration allows performing portscans (or "Server Side Request Forgery") from "relateiq" systems to external (and potential internal systems).
the following is a sample request used (excluding cookies): POST /app/GWT.rpc HTTP/1.1 Host: app.relateiq.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:29.0) Gecko/20100101 Firefox/29.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: text/x-gwt-rpc; charset=utf-8 X-GWT-Permutation: 95882AF82F06F7F3497A1C7BDD950153 X-GWT-Module-Base: https://app.relateiq.com/app/ Referer: https://app.relateiq.com/ Content-Length: 317 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
The URL "https://127.0.0.1:1" can be changed to a different IP/DNS and TCP Port. Based on the response received it is possible to identify if a port is open, or closed/filtered.
An open port results into a HTTP Status of 504 (Gateway Timeout), or an error message of "The underlying connection was closed: An unexpected error occurred on a send" in the HTTP response.
A closed port usually results into a message of "Unable to connect to the remote server".
This was tested with some external servers and internally only against localhost. If it would change the severity of course some scans against typical private networks within that DMZ could be requested :)
For localhost on the top50 (nmap) ports the following were found open:
- 80
- 135
- 445
- 3389
- 49152
- 49154
Attached you can find some screenshots demonstrating the issue.
best
pUm