Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62143— Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

Quick assessment

Affected
misp misp-modules
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP misp-modules是MISP组织的中间件。 misp-modules v3.0.8及之前版本存在服务端请求伪造漏洞，该漏洞源于html_to_markdown模块在对比IP地址时未对IPv4映射的IPv6地址进行规范化处理，导致服务端请求伪造（SSRF）保护被绕过，可能允许经过身份验证的攻击者通过回环接口、内部网络或链接本地网络暴露内部Web服务、管理接口或云实例元数据。

AI Predicted 8.8 Difficulty: Easy EPSS 0.40% · P33

Affected Version Matrix 1

VendorProduct Version RangeStatus
misp misp-modules ≤ v3.0.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62143

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses
Source: CVE Program / CVE List V5
Vulnerability Description
A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges without first normalising IPv4-mapped IPv6 addresses. An authenticated attacker able to invoke the module could supply an IPv4-mapped IPv6 address, such as: http://[::ffff:127.0.0.1]/ http://[::ffff:169.254.169.254]/ Alternatively, the attacker could use a hostname that resolves to an IPv4-mapped IPv6 address. These addresses were treated as IPv6 addresses and therefore did not match the corresponding blocked IPv4 ranges. Successful exploitation could cause the misp-modules server to connect to services available through its loopback interface, internal network, or link-local network. This could expose internal web services, administrative interfaces, or cloud instance metadata, with retrieved content potentially returned to the attacker as converted Markdown. The vulnerability has been addressed by normalising IPv4-mapped IPv6 addresses to their underlying IPv4 representation before applying the blocked-range checks. URLs without a valid hostname are now also rejected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/RE:M/U:Green
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
misp-modules 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MISP misp-modules是MISP组织的中间件。 misp-modules v3.0.8及之前版本存在服务端请求伪造漏洞，该漏洞源于html_to_markdown模块在对比IP地址时未对IPv4映射的IPv6地址进行规范化处理，导致服务端请求伪造（SSRF）保护被绕过，可能允许经过身份验证的攻击者通过回环接口、内部网络或链接本地网络暴露内部Web服务、管理接口或云实例元数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
misp misp-modules 0 ~ v3.0.8 -

II. Public POCs for CVE-2026-62143

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62143

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-62143 (1)

IV. Related Vulnerabilities

Same product: misp-modules
Same vendor: misp
Same weakness: CWE-918

V. Comments for CVE-2026-62143

No comments yet

Leave a comment