August 19, 2026
SSRF with filter bypass via open redirection vulnerability | portswigger writeup
Introduction
By Ali Amed
2 min read
Introduction
After reading the challenge description, we discovered that there was a Stock API responsible for returning the number of available products. However, it did not appear to accept arbitrary URLs directly(only internal url).
While inspecting the bottom of the page, we found two functions: one for retrieving the next product and another for retrieving the product list.
We intercepted the requests using Burp Suite and sent them to Repeater. We noticed that the GET request contained a parameter named path.
Identifying the SSRF
We started testing the path parameter by providing an external URL such as:
The application redirected us to YouTube, which indicated that the server was processing the URL provided through the path parameter, But it doesn't accept internal admin url.
This suggested that the parameter could potentially be vulnerable to Server-Side Request Forgery (SSRF).
Accessing the Internal Admin Panel
We first tried to access the Admin page directly, but we did not get any useful result.
Since the Stocks was designed to retrieve internal URLs, we tried targeting the internal server instead.
We used:
/product/nextProduct?currentProductId=3&path=http://192.168.0.12:8080/admin
After URL-encoding the request and sending it through Burp Suite, the response contained the Admin panel.
Deleting Carlos
After gaining access to the Admin panel, we searched for Carlos.
We found a link responsible for deleting his account. We copied the deletion URL and replaced the previous URL with it in our SSRF request.
The server then processed the internal request and deleted Carlos.
The lab was successfully solved.
