search

PortSwigger / url-cheatsheet-data

This is the data that powers the PortSwigger URL validation bypass cheat sheet.
https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet
30 stars 4 forks source link

Localhost regex implementation edge case for CORS bypass. #2

Closed t0xodile closed 2 months ago

t0xodile commented 2 months ago

I've come across apps that, as mentioned in the cheat sheet, trust https://localhost. However, when I've come across this, the implementation is sometimes flawed and "https://localhost.attacker-domain.com" will also work. Perhaps this is covered enough by the examples? But maybe worth an add?

d0ge commented 2 months ago

Thank you very much for your contribution to the URL validation bypass cheat sheet. Interestingly, when I tested this case, the server more often trusted the unencrypted connection, which confirms that the code checks if the string starts with http://localhost. May I ask you to send me your handle on X.com (formerly Twitter.com)? Alternatively, I can use a link to your profile on GitHub if that’s more convenient for you.

Cheers!

t0xodile commented 2 months ago

Hej! Sure thing, its the same as here -> https://x.com/t0xodile Sounds much more legit that it trusts http for localhost to be honest. But I've definitely seen the behavior I described in the wild. I guess its a double-layer of badly implemented origin validation...