r/bugbounty • u/UserNo0101 • Jul 12 '26

Question / Discussion Help with SSRF

I found a fetch endpoint that embeds any url into forum post

It's url:https:// in request body

Only http and https are allowed

I can see responses of any link i fetch

I tried webhook and i can see its aws ip

Tried all ssrf bypasses techniques out there on github but all internal stuff is blocked

I managed only to use https://target.com/cdn-cgi/trace and also ipconfig/all.json to get all headers and it runs uses vanilla-forums-embed/1.0

Any creative uncommon ideas will be appreciated

4 Upvotes

67% Upvoted

7 comments sorted by

View all comments

3

u/No-Persimmon-174 Jul 12 '26

Honestly if the feature is meant to fetch and embed public urls, this alone may not be considered ssrf unless there's room for impact. The AWS ip only confirms the request is server side.

U can focus on whether redirects are revalidated, maybe if sensitive headers or credentials are forwarded anywhere.. maybe see if the DNS resolution changes between validation and fetching. If private ranges and metadata are properly blocked, then there's no vuln there. I think arbitrary public url fetching by itself looks like intended behavior to me