Trust Transit

A Kotlin (Ktor) app, and the server even names the vuln class in its response: SSRF → object authorization. /api/topology leaks an internal service at http://127.0.0.1:8080/status-8f4309 that trusts requests by network origin (loopback = trusted). /api/cases lists case 4334 (mine, analyst) and 11581 (the executive's, off-limits). /submit-90943c?target= is a server-side fetcher.

Hitting /status-8f4309 directly gives 403 internal_service_only. But tunneling it through the SSRF makes the request arrive from the server itself — i.e. as loopback — and once you're trusted, the service hands over any case id with no owner check. So one request defeats both the network boundary and object-level authz:

/submit-90943c?target=http://127.0.0.1:8080/status-8f4309?id=11581
  →  {"ok":true,"effect":"ssrf_then_object_authorization","evidence":"proof_..."}

The path had to be exactly /status-8f4309 and the param had to be ?id= (not case=), pointing at the executive's 11581. The internal service gates on where the request comes from instead of who you are — chain SSRF to satisfy "where," IDOR to pick "what."