# FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.com

GitLab's FogBugz importer used Kernel.Open to fetch attachment URLs, allowing GET SSRF to localhost if a fogbugz.com subdomain returned a crafted API response.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: ajxchapman
- Disclosed: 2021-07-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1092230
- Library page: https://bugbountylibrary.com/r/h1%3A1092230
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:high tech:ruby technique:chained technique:source-review vuln:ssrf

**Target:** FogBugz import attachment download service (app/services/projects/download_service.rb)
**Root cause:** CarrierWave download! uses Kernel.Open, which follows URLs resolving/redirecting to 127.0.0.1; the only guard is a host whitelist regex on *.fogbugz.com, so a compromised fogbugz.com subdomain returning a crafted API response yields SSRF.
**Steps:**
1. Add `/etc/hosts` entry `198.211.125.160 poc.fogbugz.com` pointing to attacker VPS serving crafted FogBugz API response.
2. Craft API response whose attachment URL points to `http://127.0.0.1:9090/api/v1/targets`.
3. Import the 'SSRF Repository' FogBugz repo from poc.fogbugz.com in GitLab.
4. Observe created issue containing the SSRF-fetched localhost response.
**How found:** Code review of the FogBugz import download service revealed Kernel.Open usage and a whitelist-only URL check; researcher reasoned that any fogbugz.com subdomain compromise would bypass the guard.
**Exploitation:** Requires a vulnerability on a *.fogbugz.com subdomain (redirect, subdomain takeover, request smuggling, cache poisoning, SQLi, etc.) to return an arbitrary attachment URL; importer then GETs internal endpoints and stores the response as an issue attachment.
**Insight:** When a URL whitelist is the only SSRF defense, check whether the underlying HTTP client (Kernel.Open) follows redirects or resolves to loopback; whitelisted third-party domains become an SSRF pivot if any subdomain is takeover-able.