# SSRF in imgur video GIF conversion

Imgur's /vidgif/upload endpoint fetched attacker-supplied URLs server-side, enabling SSRF to internal services via HTTP, FTP, and gopher with CRLF header injection.

- Payout: hidden
- Severity: high
- Program: Imgur
- Found by: mariuszdeepsec
- Disclosed: 2020-08-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/247680
- Library page: https://bugbountylibrary.com/r/h1%3A247680
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:high technique:incomplete-fix technique:regression vuln:ssrf

**Target:** /vidgif/upload endpoint (video-to-GIF conversion service)
**Root cause:** The vidgif conversion endpoint passed user-controlled source/url parameters to a server-side fetcher without restricting scheme or destination, allowing arbitrary internal requests.
**Steps:**
1. Send `POST /vidgif/upload` with body `source=http%3A%2F%2F192.166.218.53%2Fmalicious123.php&url=http%3A%2F%2F192.166.218.53%2Fmalicious123.php&start=56.72&stop=66.43`
2. Observe the server issuing the HTTP request to the attacker host (callback confirms SSRF)
3. Swap scheme to `ftp://` to reach internal FTP services
4. Use `gopher://` with `%0a` to inject CRLF into request headers toward internal targets
**How found:** Researcher referenced prior report 115748 (same endpoint) and probed the next-step parameters, testing alternate schemes (ftp, gopher) and CRLF injection to extend the original SSRF.
**Exploitation:** Attacker points source/url at internal or attacker-controlled hosts; server fetches them, enabling internal port scanning, metadata access, and header injection via gopher CRLF.
**Escalation:** Chaining gopher CRLF injection to craft arbitrary requests against internal services beyond simple GET.
**Insight:** When a prior SSRF was patched on a media-conversion endpoint, re-test the same parameters with alternate schemes (gopher/ftp) and CRLF payloads—fixes often only block http(s) or the original param.