SSRF Defense Fix: Azure Metadata & IPv4 Translation Prefix Handling

Vulnerability Overview This commit ( ) addresses issues in handling IPv4 translation prefixes and additional reserved ranges within the SSRF deny-list, specifically related to Block Azure WireServer. The fix involves recognizing and blocking Azure metadata channel addresses such as , , , and , thereby preventing SSRF protection from being bypassed via IPv4 translation prefixes. Scope of Impact Affected Components: and . Affected Scenarios: - Azure WireServer platform metadata channels ( , , ). - IPv4 translation prefixes (e.g., ) may embed external IPv4 addresses within IPv6. If these embedded addresses are not properly validated, it could lead to SSRF bypass. - Reserved ranges such as and , which are not globally reachable network segments. Fix Details 1. Update : - Added recognition of Azure metadata channel addresses ( , , ) in the function. - Added validation for the IPv4 translation prefix ( ) to ensure that embedded IPv4 addresses are correctly checked. - Updated the CIDR definitions for and to cover additional reserved ranges. 2. Update : - Added test cases to verify that addresses like , , and are correctly identified as internal IPs. - Added tests for the IPv4 translation prefix to ensure embedded IPv4 addresses are correctly validated. POC Code ```go // Test code in tools_test.go func TestIsInternalIP(t *testing.T) { internal := []string{ "10.0.0.0/8", "169.254.0.0/16", "169.254.128.0/25", "169.254.192.0/26", "240.0.0/4", "240.63.128.0/24", "::ffff:0:0/96", "::ffff:0:0/96", } external := []string{ "8.8.8.8", "1.1.1.1", "8.8.4.4", "9.9.9.9", "1.0.0.1", "1.0.0.2", "1.0.0.3", "1.0.0.4", "1.0.0.5", "1.0.0.6", "1.0.0.7", "1.0.0.8", "1.0.0.9", "1.0.0.10", "1.0.0.11", "1.0.0.12", "1.0.0.13", "1.0.0.14", "1.0.0.15", "1.0.0.16", "1.0.0.17", "1.0.0.18", "1.0.0.19", "1.0.0.20", "1.0.0.21", "1.0.0.22", "1.0.0.23", "1.0.0.24", "1.0.0.25", "1.0.0.26", "1.0.0.27", "1.0.0.28", "1.0.0.29", "1.0.0.30", "1.0.0.31", "1.0.0.32", "1.0.0.33", "1.0.0.34", "1.0.0.35", "1.0.0.36", "1.0.0.37", "1.0.0.38", "1.0.0.39", "1.0.0.40", "1.0.0.41", "1.0.0.42", "1.0.0.43", "1.0.0.44", "1.0.0.45", "1.0.0.46", "1.0.0.47", "1.0.0.48", "1.0.0.49", "1.0.0.50", "1.0.0.51", "1.0.0.52", "1.0.0.53", "1.0.0.54", "1.0.0.55", "1.0.0.56", "1.0.0.57", "1.0.0.58", "1.0.0.59", "1.0.0.60", "1.0.0.61", "1.0.0.62", "1.0.0.63", "1.0.0.64", "1.0.0.65", "1.0.0.66", "1.0.0.67", "1.0.0.68", "1.0.0.69", "1.0.0.70", "1.0.0.71", "1.0.0.72", "1.0.0.73", "1.0.0.74", "1.0.0.75", "1.0.0.76", "1.0.0.77", "1.0.0.78", "1.0.0.79", "1.0.0.80", "1.0.0.81", "1.0.0.82", "1.0.0.83", "1.0.0.84", "1.0.0.85", "1.0.0.86", "1.0.0.87", "1.0.0.88", "1.0.0.89", "1.0.0.90", "1.0.0.91", "1.0.0.92", "1.0.0.93", "1.0.0.94", "1.0.0.95", "1.0.0.96", "1.0.0.97", "1.0.0.98", "1.0.0.99", "1.0.0.100", "1.0.0.101", "1.0.0.102", "1.0.0.103", "1.0.0.104", "1.0.0.105", "1.0.0.106", "1.0.0.107", "1.0.0.108", "1.0.0.109", "1.0.0.110", "1.0.0.111", "1.0.0.112", "1.0.0.113", "1.0.0.114", "1.0.0.115", "1.0.0.116", "1.0.0.117", "1.0.0.118", "1.0.0.119", "1.0.0.120", "1.0.0.121", "1.0.0.122", "1.0.0.123", "1.0.0.124", "1.0.0.125", "1.0.0.126", "1.0.0.127", "1.0.0.128", "1.0.0.129", "1.0.0.130", "1.0.0.131", "1.0.0.132", "1.0.0.133", "1.0.0.134", "1.0.0.135", "1.0.0.136", "1.0.0.137", "1.0.0.138", "1.0.0.139", "1.0.0.140", "1.0.0.141", "1.0.0.142", "1.0.0.143", "1.0.0.144", "1.0.0.145", "1.0.0.146", "1.0.0.147", "1.0.0.148", "1.0.0.149", "1.0.0.150", "1.0.0.151", "1.0.0.152", "1.0.0.153", "1.0.0.154", "1.0.0.155", "1.0.0.156", "1.0.0.157", "1.0.0.158", "1.0.0.159", "1.0.0.160", "1.0.0.161", "1.0.0.162", "1.0.0.163", "1.0.0.164", "1.0.0.165", "1.0.0.166", "1.0.0.167", "1.0.0.168", "1.0.0.169", "1.0.0.170", "1.0.0.171", "1.0.0.172", "1.0.0.173", "1.0.0.174", "1.0.0.175", "1.0.0.176", "1.0.0.177", "1.0.0.178", "1.0.0.179", "1.0.0.180", "1.0.0.181", "1.0.0.182", "1.0.0.183", "1.0.0.184", "1.0.0.185", "1.0.0.186", "1.0.0.187", "1.0.0.188", "1.0.0.189", "1.0.0.190", "1.0.0.191", "1.0.0.192", "1.0.0.193", "1.0.0.194", "1.0.0.195", "1.0.0.196", "1.0.0.197", "1.0.0.198", "1.0.0.199", "1.0.0.200", "1.0.0.201", "1.0.0.202", "1.0.0.203", "1.0.0.204", "1.0.0.205", "1.0.0.206", "1.0.0.207", "1.0.0.208", "1.0.0.209", "1.0.0.210", "1.0.0.211", "1.0.0.212", "1.0.0.213", "1.0.0.214", "1.0.0.215", "1.0.0.216", "1.0.0.217", "1.0.0.218", "1.0.0.219", "1.0.0.220", "1.0.0.221", "1.0.0.222", "1.0.0.223", "1.0.0.224", "1.0.0.225", "1.0.0.226", "1.0.0.227", "1.0.0.228", "1.0.0.229", "1.0.0.230", "1.0.0.231", "1.0.0.232", "1.0.0.233", "1.0.0.234", "1.0.0.235", "1.0.0.236", "1.0.0.237", "1.0.0.238", "1.0.0.239", "1.0.0.240", "1.0.0.241", "

Goal Reached Thanks to every supporter — we hit 100%!

SSRF Defense Fix: Azure Metadata & IPv4 Translation Prefix Handling

More from this source