# Critical SSRF on Evernote

Evernote's /ro/ endpoint base64-decoded a URL and fetched it, allowing SSRF to GCP metadata to steal an access token and read local files.

- Payout: $5,000
- Severity: critical
- Program: Evernote
- Credited: Neolex
- Disclosed: 2022-03-31
- Write-up quality: 6/10
- Original: https://blog.neolex.dev/13/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-neolex-dev-13
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:gcp technique:chained technique:recon vuln:ssrf

**Target:** Evernote /ro/ base64 URL fetch endpoint
**Root cause:** The /ro/ endpoint base64-decodes a user-supplied value and fetches it server-side, with only a weak whitelist requiring the path to end in .css or .js.
**Steps:**
1. Observe request to /ro/<base64> returning decoded file content, e.g. base64 of `/f6cdd4bdfa4c1b86f441c7c29f072e511dd34501.css`.
2. Note whitelist requires URL/path ending in .css or .js.
3. Bypass with fragment: base64 of `http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token#.js`.
4. Request `https://www.evernote.com/ro/<base64>/-1430533899.js` to retrieve GCP access token.
5. Also fetch local files via base64 of `file:///etc/passwd#.js`.
**How found:** Noticed a /ro/ request with a base64 value that decoded to a .css path whose content was reflected in the response, hypothesizing SSRF; trial and error revealed a .css/.js suffix whitelist, bypassed with a # fragment.
**Exploitation:** Attacker supplies a base64-encoded URL to /ro/; server fetches it and returns the body. Using the GCP metadata endpoint, the attacker obtains a Bearer access token; file:// scheme reads local files.
**Escalation:** Chained SSRF to GCP metadata credential theft and local file read via file:// scheme.
**Insight:** When a fetcher whitelists by file extension, append `#.js`/`#.css` as a URL fragment so the check passes while the fragment is never sent to the target; also test file:// scheme for local file read.