Lab: SSRF with filter bypass via open redirection vulnerability
Summary: PortSwigger's lab presents a stock check feature that fetches data from an internal system, and the stock checker is restricted to only access the local application. To solve it, a tester must find an open redirect on the application, build a URL that redirects to the admin interface at http://192.168.0.12:8080/admin, feed it into the stockApi parameter, and amend the path to delete the user carlos.
What's compelling: The lab shows that an allowlist limiting a server-side fetch to the local application can be bypassed through an open redirect the application itself hosts, reaching an internal admin interface on 192.168.0.12:8080 and deleting a user.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026