# Infrastructure - Photon - SSRF

Photon image proxy follows redirects to arbitrary internal IPs/ports and forwards Basic auth credentials, enabling SSRF-based port scanning and internal service attacks.

- Payout: hidden
- Severity: medium
- Program: WordPress
- Found by: skansing
- Disclosed: 2017-07-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/204513
- Library page: https://bugbountylibrary.com/r/h1%3A204513
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:php technique:chained vuln:ssrf

**Target:** Photon image proxy service (i0.wp.com)
**Root cause:** Photon restricts redirect protocols to HTTP/HTTPS via CURLOPT_REDIR_PROTOCOLS but does not block redirects to internal IPs, arbitrary ports, or URLs containing auth credentials, which cURL then forwards.
**Steps:**
1. Request `http://i0.wp.com/159.203.190.123:666/new.php?resize=0,1` to confirm port restriction blocks direct requests.
2. Host `new.php` returning `header('Location: http://admin:admin@159.203.190.123:666');`.
3. Request `http://i0.wp.com/159.203.190.123/new.php?resize=0,2` (bump resize param to bust cache).
4. Photon follows the 302 and sends `GET / HTTP/1.1` with `Authorization: Basic YWRtaW46YWRtaW4=` to the internal host:port, observed via `nc -l -p 666`.
**How found:** Noticed Photon only restricted redirect protocols, not destination IPs/ports, and tested whether a 302 to an internal IP with a non-standard port and embedded credentials would be followed.
**Exploitation:** Attacker controls a redirect target that points Photon at any internal IP and port, with optional Basic auth headers, letting them scan internal HTTP services and hit authenticated internal endpoints from Photon's network position.
**Insight:** When a proxy restricts redirect protocols, test whether it still follows redirects to internal IPs, non-standard ports, and URLs with userinfo (user:pass@) that cURL converts into Authorization headers.