Summary by Bupa Australia Vulnerability Disclosure Engagement
A server-side request forgery risk through image proxy. The report helped tightening validation.
Blind SSRF in `/api/img` on blua.bupa.com.au — internal host discovery & port scanning of `*.internal.bupa.com.au`
Disclosed by x3c- Engagement Bupa Australia Vulnerability Disclosure Engagement
- Disclosed date 6 days ago
- Priority P3 Bugcrowd's VRT priority rating
- Status Resolved This vulnerability has been accepted and fixed
Summary by x3c
An image proxy accepted requests to internal resources, creating a server-side request forgery risk despite an external host allowlist. The report recommends excluding internal address space and tightening destination validation.