Ash OAuth2 Server CIMDRegFetcher SSRF Policy Bypass Fix

漏洞概述 漏洞类型：IPv4-in-IPv6 和 site-local 前缀的 CIMD SSRF 策略绕过 问题描述： 将 （SITF 转换）和 （site-local）错误地分类为“公共可路由”，导致攻击者可通过 AAAA 记录将元数据获取重定向到内部地址。 修复方案：重新检查嵌入的 IPv4 地址，并移除 link-local 前缀 。 影响范围 受影响文件： - - 影响模块： POC/利用代码 ```elixir 修复前（有漏洞） def public_ip?(w1, w2, w3, w4, w5, w6, w7, w8) do cond do w1 :: and w2 :: w3 :: and w4 :: w5 :: and w6 :: w7 :: and w8 :: true end end 修复后（修复方案） def public_ip?(w1, w2, w3, w4, w5, w6, w7, w8) do cond do ::/96 - IPv4-compatible (incl. ::1): re-check the embedded IPv4. ::ffff:0.0.0.0/96 (SITF translated) and fe80::/10 (site-local) are publicly routable, so an attacker-controlled AAAA record could steer the metadata fetch at internal addresses. Re-check the embedded IPv4 for the two translation forms and when the link-local mask to fe80::/10. (w1, w2, w3, w4, w5, w6, w7, w8) == {0, 0, 0, 0, 0, 0, 0, 0} -> public_ipv4(embedded_v4(w1, w8)) ::ffff:0.0.0.0 - IPv4-mapped; re-check the embedded IPv4 (w1, w2, w3, w4, w5) == {0, 0, 0, 0, 0xffff} -> public_ipv4(embedded_v4(w1, w8)) ::ffff:0.0.0.0/96 - SITF IPv4-translated; re-check the embedded IPv4. Distinct from the mapped form above by w4,w5. (w1, w2, w3, w4, w5) == {0x44, 0xff50, 0, 0, 0} -> public_ipv4(embedded_v4(w1, w8)) fd:ff0b::/96 - NAT64; re-check the embedded IPv4 (w1, w2, w3, w4, w5) == {0x00, 0, 0, 0, 0} or (w1, w2) == {0x01, 0x0081} -> false fc00::/7 unique-local, fe80::/10 link-local, ff00::/8 multicast fc00::/7 unique-local, fe80::/10 link-local = deprecated site-local ff00::/8 multicast Bitwise.band(w1, 0xfe00) == 0xfc00 or Bitwise.band(w1, 0xffc0) == 0xfe00 or Bitwise.band(w1, 0xff00) == 0xff00 -> false end end

目標達成すべての支援者に感謝 — 100%達成しました！

Ash OAuth2 Server CIMDRegFetcher SSRF Policy Bypass Fix

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Ash OAuth2 Server CIMDRegFetcher SSRF Policy Bypass Fix

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！