LY Corporation · Report #833758
Blind SSRF in social-plugins.line.me
Validstatus
mediumseverity
$100bounty
33upvotes
6 Oct 2022disclosed
Summary
LINE Social Plugins (https://social-plugins.line.me/) is a service that provides LINE users with content sharing on the web. This Blind SSRF attack was caused by bypassing the DNS verification of the parameter value received. It could have made requests to internal servers or scanned internal network ports.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.