Unauthenticated SSRF in `/target/api/request` allows any anonymous user to bypass documentation authentication and read protected/private docs sites cross-tenant
The affected asset is anonymised at the researcher's request.
Cross-Tenant Authentication Bypass via Unauthenticated SSRF
The target name is target.com because the bug not fixed yet .
Description
An unauthenticated attacker can bypass password/private-members authentication on any target.com documentation site by abusing the unauthenticated POST /target/api/request endpoint.
The endpoint acts as an open server-side request proxy. An attacker can supply an arbitrary URL, causing target.com infrastructure to fetch it and return the response.
When the attacker uses this endpoint to request a password-protected *target.site deployment, the request originates from target's internal infrastructure and is trusted by the documentation authentication layer. As a result, the protected site returns HTTP 200 instead of the expected HTTP 302 /login.