# Holiday Hunting With Aquatone

Screenshot-test app fetched arbitrary URLs, letting attacker read GCP VM metadata via custom headers and enumerate internal HTTP ports via JSONDecodeError oracle.

- Payout: $2,400
- Severity: high
- Program: -
- Credited: Kuldeep Pandya
- Disclosed: 2023-04-03
- Write-up quality: 6/10
- Original: https://kuldeep.io/posts/holiday-hunting-with-aquatone/
- Library page: https://bugbountylibrary.com/r/blog%3Akuldeep-io-posts-holiday-hunting-with-aquatone
- Tags: domain:web3 impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:gcp technique:recon technique:source-review vuln:ssrf

**Target:** Web page screenshot/performance test application
**Root cause:** The screenshot-test application fetched user-supplied URLs server-side without restricting internal/metadata destinations, and allowed attacker-supplied custom headers.
**Steps:**
1. Run aquatone/httpx on in-scope IPs to find live HTTP services on nonstandard ports
2. Submit `https://example.com` to the test app; observe it fetches and screenshots the URL
3. Add headers `Metadata-Flavor: Google` and `X-Google-Metadata-Request: True` via the app's header feature
4. Submit `http://metadata.google.internal/computeMetadata/v1/instance/disks/?recursive=true`
5. Click 'View JSON result' and read the `html` field to exfiltrate metadata
6. For port scan: set `url` param to `http://127.0.0.1:§1§` in Intruder 1-5000; JSONDecodeError indicates open HTTP port, ConnectionError indicates closed
**How found:** Ran aquatone across in-scope IPs; noticed a screenshot-test app that fetched arbitrary URLs. Tried localhost, file://, then GCP metadata; discovered 'View JSON result' exposed raw HTML, and a wordlist endpoint `/computeMetadata/v1/instance/disks/?recursive=true` returned data.
**Exploitation:** Attacker used the app's URL-fetch and custom-header features to reach GCP metadata endpoint and read disk info via the JSON result's html field; also used the url parameter as an SSRF oracle to enumerate internal HTTP ports.
**Escalation:** Same SSRF applied to other app features (custom test script, bulk testing, file upload) enabling scripted metadata retrieval.
**Insight:** When an SSRF app returns screenshots, look for a 'view JSON/raw result' feature that exposes the full response body; and use verbose JSON-decode stack traces as a port-scan oracle distinguishing open HTTP ports from closed ones.