SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function

Summary

In Rocket.Chat version 7.10.1, the oEmbed feature is enabled by default and automatically generates a preview whenever a valid URL is posted in a chat. If the URL redirects to another site, the feature follows the redirect to the final destination. While the initial URL is filtered for local IP addresses and other checks—so SSRF protections are effective—the same protections are not applied to the redirected URL. Therefore, an attacker can use a shortened URL or similar to access hosts on the internal network and obtain a preview.

Details

In my test environment, I set up an httpbin server on the same LAN as the Rocket.Chat server to verify whether SSRF was possible. The httpbin server is running at 192.168.100.9:8080, and the attacker cannot reach this server directly.

Step 1. The attacker uses a URL-shortening service to create a valid URL that redirects to http://192.168.100.9:8080. In this case I used "https://tinyurl.com/".