LY Corporation · Report #746024
SSRF on music.line.me through getXML.php
Validstatus
highseverity
$4,500bounty
135upvotes
25 Mar 2020disclosed
Summary
The reporter found an endpoint through which limited SSRF could be achieved. It was only possible to issue GET requests served over HTTPS. LFI was not possible. The maximum impact found for this issue was minor service disruption and/or limited information leakage.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.