Rockstar Games · Report #265050
Blind SSRF in emblem editor (2)
Summary
Aug 31 - Found a blind SSRF Sep 1 - Found a way to escalate - retrieving image files from the server or other places Sep 28 - Problem fixed, $1,250 bounty! Sep 29 - Found a bypass for the fix just before disclosure Oct 13 - Bypass is fixed too Oct 18 - $250 bonus for the bypass!
Most importantly, I got a cool emblem: {F224801}
How it was found
Hello,
As per your recommendation in #233301, I'm submitting a PoC for another blind SSRF in the emblem editor.
To oversight here is allowing absolute url() values for the fill attribute:
<path fill="url(https://requestb.in/15rxmgv1#test)" stroke="#a1a1a1" ...
Upon publishing an emblem containing such an element, a HTTP request to the given URL is sent from a Rockstar server. (███). The destination port can be easily modified. This doesn't seem to work without including a fragment in the URL (#test in the example above).
Further testing showed that, if a valid SVG is found at the given URL, the fill data is actually used in the final image. Fortunately, ████████ doesn't seem to support scripts, although the possibility of finding another way to exfiltrate data doesn't seem that out of reach.
I've attached the full body of the emblem I've used to confirm this bug for ease of reproduction.