Bypass of SSRF Vulnerability

How it was found

Bypass of SSRF report https://hackerone.com/reports/793704

Fix applied after reporting the actual report did not prevent from SSRF issue. https://github.com/TryGhost/Ghost/commit/47739396705519a36018686894d1373e9eb92216#diff-3aa52b4b8c6e0fb8422de65648e35887R101

The function fetchOembedData() only validates, IPv4, IPv6 and localhost:

if (!HTTP_REGEX.test(protocol) || hostname === 'localhost' || IPV4_REGEX.test(hostname) || IPV6_REGEX.test(hostname))

However, it is possible that an attacker would be able to bypass localhost validations with following domains or such:

http://spoofed.burpcollaborator.net http://localtest.me http://customer1.app.localhost.my.company.127.0.0.1.nip.io http://mail.ebc.apple.com redirect to 127.0.0.6 == localhost http://bugbounty.dod.network redirect to 127.0.0.2 == localhost

Recommendation

In order to fix, this vulnerability all the URL provided with "/ghost/api/v3/admin/oembed/?url=http://169.254.169.254/metadata/v1.json&type=embed" and URLs getting as a response should be resolved and it should again pass through the filters added to above functions.

Impact

• An attacker with publisher role (editor, author, contributor, administrator) in a blog may be able to leverage this to make arbitrary GET requests in a Ghost Blog instance's to internal external network.