connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scan

Summary

@yassinek3ch reported to us a Blind SSRF in the 8x8 Connect application, in the ChatApps module, which potentially could have allowed for internal port scans. The vulnerable API path was /api/v2/chats/image-check via the url JSON parameter.

Example:

POST /api/v2/chats/image-check HTTP/1.1
Host: connect.8x8.com
… …
Content-Type: application/json
Content-Length: 41

{"url":"http://127.0.0.1:/?a=a.png"}

We ultimately retired the entire API path, which resolved the issue.