# SSRF via 'Add Image from URL' feature

Shopify's 'Add Image from URL' feature fetched attacker-supplied URLs, and a redirect trick bypassed validation to port-scan internal hosts via SSRF.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: alpha
- Disclosed: 2015-07-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/67377
- Library page: https://bugbountylibrary.com/r/h1%3A67377
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:rest technique:recon vuln:ssrf

**Target:** Admin product image-from-URL endpoint
**Root cause:** The image import feature fetched arbitrary user-supplied URLs server-side; URL validation could be bypassed by pointing to an attacker-controlled redirector that redirects to an arbitrary host/port.
**Steps:**
1. Send `POST /admin/products/922460995/images` with `image[src]=IMAGE_URL` to trigger server-side fetch.
2. Bypass URL validation by setting `image[src]=http://hettoteam.tk/r.php?r=http://hettoteam.tk:21` so the server follows a redirect to an arbitrary port.
3. Measure HTTP response timing (RTT) to infer whether the target port is open/closed.
**How found:** Noticed the 'Add Image from URL' feature performs server-side fetches; hypothesized URL validation could be bypassed via redirect to reach arbitrary ports.
**Exploitation:** Authenticated admin request causes Shopify servers to fetch attacker-controlled URL; a redirector script redirects to arbitrary host:port, and response timing reveals port status, enabling internal network scanning.
**Insight:** When a feature fetches user-supplied URLs, test whether validation is applied only to the initial URL and not to redirect targets — a redirector you control can pivot to internal hosts/ports.