HexBrain

HackerOne · Report #288950

Additional bypass allows SSRF for internal netblocks

Validstatus
20upvotes
16 Nov 2017disclosed

How it was found

It turns out there is another bypass in the private_address_check gem. The gem does not include 0.0.0.0 in the exclusion list in the first place.

irb(main):001:0> require 'private_address_check'
=> true
irb(main):002:0> PrivateAddressCheck.private_address?("0.0.0.0")
=> false

I was able to bypass your filter by using http://0.0.0.0:22/ as you can see below:

{F238151}

Please find a hotfix for this issue attached to this report: {F238152}. The author of the gem has been notified and should hopefully provide a proper fix very soon.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original