# Into the Borg – SSRF inside Google production network

Google Sites' Caja server-side script fetcher only reached Google-internal hosts, revealing an SSRF that exposed unauthenticated Borglet status pages leaking production infrastructure data.

- Payout: $13,337
- Severity: high
- Program: Google
- Credited: Enguerran Gillier
- Disclosed: 2018-07-20
- Write-up quality: 8/10
- Original: https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/
- Library page: https://bugbountylibrary.com/r/blog%3Aopnsec-com-2018-07-into-the-borg-ssrf-inside-google-production-network
- Tags: domain:web impact:internal-access kind:bounty platform:blog sev:high tech:java technique:recon vuln:ssrf

**Target:** Google Caja server-side script fetcher used by Google Sites
**Root cause:** The Caja server-side fetcher for remote <script src> resources ran inside Google's internal network and fetched arbitrary URLs without restricting to public internet, so internal 10.x.x.x addresses were reachable.
**Steps:**
1. Host a JS file on Google App Engine and reference it as an external script in a Google Sites page; observe fetch originates from 10.x.x.201.
2. Set the external script URL to `http://10.x.x.201/` and update the page.
3. Observe ~1MB response from the internal Borglet status monitoring page.
4. Request `http://10.x.x.1/` and `http://10.x.x.1/getstatus` for more Borglet details.
5. Attempt `http://10.x.x.1/getFile?FileName=/sys/borglet/borglet.INFO` (returned unauthorized).
**How found:** Noticed Caja's server-side fetcher refused external hosts like facebook.com but accepted Google-owned URLs, hypothesizing the fetch happened on the internal network; confirmed by hosting JS on App Engine and checking source IP in logs, then probing the private IP directly.
**Exploitation:** Attacker controls a Google Sites page and points an external script src at internal RFC1918 addresses; the Caja backend fetches the URL from inside Google's network and returns the response body to the attacker, disclosing unauthenticated Borglet monitoring pages.
**Escalation:** Attempted pivot to file read via /getFile?FileName= and other internal endpoints, but authentication blocked further access.
**Insight:** When a server-side fetcher behaves as if it has a restricted allowlist (only 'own' domains work), that asymmetry often means it runs inside the internal network — confirm via a controlled origin you can log, then probe RFC1918 addresses directly.