ESCALATED: Blind SSRF on FogBugz

HackerOne report #505844 by ngalog on 2019-03-06, assigned to asaba:

Summary:
Another blind ssrf found in fogbugz import

Steps To Reproduce:

• visit https://:gitlab_instance/import/fogbugz/new
• fill in details as below

http://127.5.5.5:1234  
something  
something  

setup a listener in gitlab instance on port 1234

• click continue to next step
• you will see POST http request going to your localhost

Impact

blind post ssrf