Concrete CMS · Report #863221
SSRF bypass
Validstatus
lowseverity
15upvotes
4 Oct 2021disclosed
How it was found
This simply describes a bypass for report at https://hackerone.com/reports/243865, using a decimal notation encoded IP address (0177.0.0.1 ) currently bypasses the limitations in place for localhost. crayons (re-submitting report including "magic" string) Concrete5 version used is 8.5.2
Impact
Interacting with local services, impact may vary depending on services actually exposed.