地图 / SSRF chained to hit internal host leading to another SSRF which allows to read internal images.

SSRF chained to hit internal host leading to another SSRF which allows to read internal images.

服务端请求伪造 / SSRF / #826097

厂商: PlayStation
严重程度: 中危
赏金: $1,000
弱点: SSRF
研究员: @bugdiscloseguys
披露日期: 2021-03-30
资产: *.playstation.net
CVE: —

该报告还没有中文解读。

时间线

2020-03-21报告提交
2021-03-30公开披露

阅读 HackerOne 原文 ↗作者 @bugdiscloseguys · 版权归作者与 PlayStation 所有

同类报告

SSRF in Exchange leads to ROOT access in all instancesShopify · 2018-05-23 Server Side Request Forgery (SSRF) via Analytics ReportsHackerOne · 2023-12-08 · $25,000 Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataSnapchat · 2020-11-30 Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosureDropbox · — · $4,913 SSRF on project import via the remote_attachment_url on a NoteGitLab · 2020-06-07 · $10,000 Server Side Request Forgery mitigation bypassGitLab · 2020-04-18