# Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusion

Evernote's /ro/ base64 path endpoint fetched arbitrary URLs and file:// URIs, enabling SSRF to AWS metadata and local file read.

- Payout: hidden
- Severity: critical
- Program: Evernote
- Found by: neolex
- Disclosed: 2021-12-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1189367
- Library page: https://bugbountylibrary.com/r/h1%3A1189367
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:aws technique:source-review vuln:path-traversal vuln:ssrf

**Target:** www.evernote.com /ro/ resource-fetch endpoint
**Root cause:** The /ro/<base64>/-<id>.js endpoint base64-decodes the path segment and fetches it without restricting scheme or host, so file:// and internal http:// URLs are retrieved and returned.
**Steps:**
1. Request `https://www.evernote.com/ro/ZmlsZTovLy9ldGMvcGFzc3dkIy5qcw==/-1430533899.js` where base64 decodes to `file:///etc/passwd#.js` to read local files.
2. Request `https://www.evernote.com/ro/aHR0cDovLzE2OS4yNTQuMTY5LjI1NC8jLmpz/-1430533899.js` decoding to `http://169.254.169.254/#.js` to hit AWS metadata.
3. Append `#.js` so the trailing `.js` requirement is satisfied while the fragment is ignored by the fetched URI.
**How found:** Noticed the endpoint takes a base64 path and retrieves its content; hypothesized it was meant for paths but would accept full URLs and file URIs, then tested file:// and 169.254.169.254.
**Exploitation:** Attacker crafts base64-encoded file:// or internal http:// URIs in the /ro/ path; server fetches them and returns full response body, leaking local files and AWS instance metadata.
**Insight:** When an endpoint base64-encodes a path and fetches it, decode the parameter and try swapping the path for a full URL or file:// URI; use a #fragment to satisfy trailing-extension checks while the fragment is stripped from the fetched resource.