# Blind SSRF in emblem editor (2)

Emblem editor accepted absolute url() in SVG fill attribute, causing Rockstar servers to fetch attacker URLs (blind SSRF), later escalated to retrieve image files.

- Payout: $1,500
- Severity: medium
- Program: Rockstar Games
- Credited: alexbirsan
- Disclosed: 2017-10-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/265050
- Library page: https://bugbountylibrary.com/r/h1%3A265050
- Tags: domain:web impact:internal-access kind:bounty platform:hackerone sev:medium technique:incomplete-fix technique:oob-exfil vuln:ssrf

**Target:** Emblem editor SVG renderer on socialclub.rockstargames.com
**Root cause:** The emblem editor allowed absolute url() values in the SVG fill attribute, so the server-side renderer fetched arbitrary remote URLs when publishing an emblem.
**Steps:**
1. Craft emblem SVG with `<path fill="url(https://requestb.in/15rxmgv1#test)" stroke="#a1a1a1" ...>`
2. Include a URL fragment (`#test`) — required for the request to fire
3. Publish the emblem
4. Observe HTTP request from Rockstar server to the attacker URL; port is freely modifiable
5. Host a valid SVG at the URL to have its fill data used in the final rendered image
**How found:** Followed up on a prior report (#233301) per program recommendation; noticed the editor permitted absolute url() in fill, tested with a requestb.in URL and found a fragment was needed to trigger the request.
**Exploitation:** Attacker publishes an emblem whose SVG fill references an absolute external URL; the server-side renderer issues an outbound HTTP request to that URL (any port), enabling blind SSRF and, when a valid SVG is served, pulling remote image content into the rendered emblem.
**Escalation:** Escalated from blind SSRF to retrieving image files from the server/other locations; after the fix, found a bypass that was also patched.
**Insight:** SVG fill/stroke url() references are a classic SSRF sink in server-side image renderers — test absolute URLs there, and note fragments may be required to trigger fetches; also check whether fetched SVG content is rendered back into output for data exfil.