Researchers discovered an SSRF vulnerability on Airbnb by chaining a third-party open redirect in LivePerson's chat integration, leveraging automated JavaScript endpoint discovery and LivePerson's visitorWantsToChat API parameter to redirect internal API requests to attacker-controlled URLs. Additionally, relative path traversal via encoded backslashes in the path parameter enabled access to non-API endpoints on the LivePerson domain.
Ron Chan discovered an SSRF vulnerability in Google Cloud Platform's Stackdriver Debug feature that allowed attackers to intercept OAuth access tokens from Bitbucket, GitHub, or GitLab by exploiting an unvalidated URL parameter in the resource listing endpoint, which forwarded requests with the user's authorization token to arbitrary attacker-controlled servers.