A quick video post showing the XSPA/SSRF bug found with Adobe’s Omniture web application. This bug allowed for local file reads apart from being able to make arbitrary network requests.

This is a video demonstrating the XSPA / SSRF vulnerability that I discovered on the Adobe’s Omniture Web Application back in November 2012 while writing a paper for BlackHat2012 AD. This was a typical XSPA / SSRF bug that allowed, amongst other things, to port scan Internet facing servers using Adobe’s machines, read local files using the file:// protocol and detect internal machines and services running on them.

To read more about XSPA/SSRF issues - Cross Site Port Attacks - XSPA - Part 1

Adobe has now fixed this issue and put me on the Adobe’s Acknowledgement page for Security Researchers.