HackerOne · Report #2035332
RXSS at image.hackerone.live via the `url` parameter
Validstatus
lowseverity
$500bounty
171upvotes
11 Aug 2023disclosed
How it was found
good day
https://image.hackerone.live:8443/;/;/resource/md/get/url?url=http://oast.pro
is allowing full read ssrf wirh permission can try for aws creds.
-Eric
Impact
full read ssrf