# SSRF via credential-decrypting proxy Unauthenticated handler decrypts caller URL with static/default key, then fetches it server-side _Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2026-06-08. Updated 2026-10-24._ ## How it works A server-side endpoint takes a URL (or a value that decrypts to one) from an unauthenticated caller and makes an outbound request to it. The assumption that breaks: the code treats successful decryption as proof of trust, so only trusted parties are thought able to produce a valid ciphertext. When the key is static, hardcoded, or has a default fallback, anyone can produce a valid ciphertext and the decrypt-then-fetch path becomes an open proxy. A related shape: a handler simply skips the auth check its siblings enforce, so caller data reaches the request sink unchecked [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md). ## Where it shows up - Handlers marked anonymous or `` (e.g. `.ashx`, MVC controllers) taking a URL, `baseUrl`, `address`, or `endpoint` parameter [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md) - Custom crypto with a key resolver that falls back to a default key version (`kv0`, null) or a hardcoded master key [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054.md) - Password encryption using a static key with a salt derived from a publicly disclosed deployment serial number [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md) - Socket.IO/websocket event handlers that omit the auth helper their sibling handlers call [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md) - Any decrypt-then-`axios.get`/HTTP-client sink where the decrypted value is used directly as a request target [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md) ## How to review Trace every unauthenticated entry point to its outbound-request sink. The invariant: the destination of a server-side request is never derived from caller-supplied data unless the caller is authenticated and the destination is checked against an allowlist. For crypto paths, confirm the key is secret, per-deployment, and has no default/fallback branch; successful decryption must not be treated as authorization. For event handlers, diff each against siblings that call the authorization helper and confirm none are missing it. Check whether the response body is returned to the caller, which turns SSRF into a read primitive [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md). ## Variants seen - Anonymous controller passes attacker `baseUrl`/`userId` into a login request carrying the user's encrypted password; static key plus serial-derived salt lets the password be decrypted [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md) - `.ashx` handler decrypts a `Url` parameter with a hardcoded default master key and proxies it [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054.md) - Socket.IO handlers skip `isSocketWriteAuthorized()` and pass `property.address` to `axios.get`, echoing the response [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md) ## Impact and severity Unauthenticated SSRF in all three [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md). In E1 it chained to decryption of all user passwords, then post-auth path traversal and Net-NTLMv2 hash theft. Severity rises when the response is returned to the caller [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md), when the proxy carries credentials [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md), or when it chains into further primitives [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md). ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-vulnerabilities-to-criticality-in-progress-whatsup-gold.md - E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054.md - E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-w86f-rf9w-h3x6.md