https://blog.msnieman.com/tags/ssrf/Recent content in SSRF on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/LDAP injection on a Next.js intranet leaks a service-account secret that unlocks Gitea; a custom Ghost CMS file-read exposes an RCE dev key; from there, MSSQL linked-server SA impersonation provides a Windows foothold, and a cross-forest Kerberos golden ticket via Mimikatz completes the domain compromise.https://blog.msnieman.com/writeups/sea/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/sea/A WonderCMS site’s contact form SSRF is weaponized to deliver CVE-2023-41425, landing a shell as www-data; a password hash found in the CMS database cracks to pivot to a user account, and an internal monitoring service running as root is exploited to escalate.https://blog.msnieman.com/writeups/lantern/Tue, 20 Aug 2024 00:00:00 +0000https://blog.msnieman.com/writeups/lantern/A Skipper proxy CVE-2022-38580 SSRF exposes an internal Blazor WebAssembly app whose DLL contains base64-encoded admin credentials; those credentials log into the app, whose source code reveals a path traversal on /PrivacyAndPolicy and a DLL-loading component endpoint; a crafted Blazor component DLL reads tomas’s SSH private key, and procmon-based inspection of a root-run binary leads to privilege escalation.