Writeup — Basic SSRF Against the Local Server

This lab covers a Server-Side Request Forgery (SSRF) vulnerability. SSRF occurs when an application fetches data from a user-controlled URL without proper validation.

The goal of this lab is to exploit SSRF to access the administrator panel running on http://localhost/admin and use that access to delete the user 'carlos'.

As a first step before starting the exploit, I tested the application by trying to access the:

/admin

/admin

endpoint directly through my browser.

The result showed that the administrator page could not be accessed by a regular user. This indicated that the admin panel was restricted and could only be reached from the server's internal environment.

Next, I generated a request in Burp Suite by using the "Check stock" feature on one of the products on the website. When I checked my POST request in the HTTP History, I found a parameter named stockApi. This parameter contained the destination URL that the server accesses to fetch product stock information.

I sent this request to the Repeater and changed the value of the stockApi parameter to:

http://localhost/admin

http://localhost/admin

The goal of this change was to use the server as a middleman to access the restricted administrator panel hosted on localhost.

When I sent the request, the server fetched that address and returned the content of the administrator page inside the HTTP response. This successfully proved that the stockApi parameter was vulnerable to SSRF.

Looking through the HTML response of the admin page, I found the feature to delete users.

After analyzing the source code, I discovered this specific endpoint:

http://localhost/admin/delete?username=carlos

http://localhost/admin/delete?username=carlos

This is the exact endpoint used by the administrator to delete the user account named 'carlos'.

Since I had found the deletion endpoint, all I had to do was replace the stockApi URL in my request with that exact endpoint. By doing this, the user 'carlos' should be deleted.

Sure enough, the exploit worked! By manipulating the stockApi parameter, I forced the server to access its own internal service. Through this SSRF technique, I bypassed the external restrictions, accessed the administrator page, executed the user deletion endpoint, and successfully deleted the carlos account.

Quick Breakdown Uhuk!!

SSRF vulnerabilities happen because an application allows users to control the URL that the server accesses without proper validation. As a result, an attacker can use the server as a proxy to access internal systems that shouldn't be reachable from the outside internet. In this lab, SSRF was used to access a restricted administrator panel on localhost and execute an administrative function to delete a user account.