mirror of
https://github.com/alexta69/metube.git
synced 2026-09-21 13:35:01 +00:00
Alex Shnitman
7082858237
The SSRF guard classified addresses with ipaddress.is_global, which looks only at the outer address. An IPv6 form that carries an IPv4 address at a fixed offset therefore passed a check the bare address would have failed: the NAT64 well-known prefix 64:ff9b::/96 sits in the 2000::/3 global unicast range, so 64:ff9b::a9fe:a9fe was accepted while 169.254.169.254 was refused. The deprecated IPv4-compatible form ::/96 has the same property. Both the ingress validator and the connect-time socket guard classified through the same helper, so both were affected. Judge every address a verdict has to account for: the outer address plus any IPv4 it tunnels, allowed only when all of them are global. Unwrapping this way can only tighten the verdict, which matters for 6to4 and Teredo — Python already rejects 2002::/16 and 2001::/32 wholesale, and replacing the outer address with its payload would have turned 2002:0808:0808:: from blocked into allowed. Reaching an internal service this way additionally requires NAT64 routing on the host network, which the attacker does not control. Reported by tonghuaroot in GHSA-5mq5-qr7m-f4wx. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>