Lab 341 — KeyVault2FA — SSRF via OTP Account Import

hackadvisor

Task: KeyVault2FA 2FA management platform with OTP account import that fetches icon URLs server-side without validation. Solution: Exploit SSRF via image parameter in otpauth:// URI to access internal config service on localhost:3001/flag, with non-image response body leaked in body_preview field.