lancet SSRF Bypass: IsInternalIP fails to identify IPv6 unique-local, link-local, and encapsulated internal addresses

Vulnerability Overview Vulnerability Name: IsInternalIP Misclassification of IPv6 Private/Link-Local Addresses and Internal IPv4 Targets Encapsulated within IPv6 Tunnels as External #356 Vulnerability Description: The function (located in ) is documented as a general-purpose tool for "verifying whether an IP address is internal or external." However, the function only recognizes IPv4 loopback addresses (such as ) and three hardcoded IPv4 ranges. For all other cases, including any standard IPv6 addresses (where returns ), it unconditionally returns . This implies: - Native IPv6 private addresses (such as ), link-local addresses (such as ), and unspecified ranges are not identified as internal. - IPv6 CGNAT addresses (such as , RFC 6598) are not recognized. - Internal IPv4 targets embedded within IPv6 transition mechanisms (such as NAT64, 6to4, and Teredo), like (AWS/GCP/Azure cloud instance metadata services), are not identified because these formats are not normalized via . Impact Scope Affected Versions: commit 7476dd Specific Impact: - Any project using to verify the resolved IP of a user-provided URL before making outbound requests (a standard SSRF mitigation use case) can be bypassed by returning one of the aforementioned encapsulated or native IPv6 formats. - This may lead to reaching cloud instance metadata services or other internal network targets via DNS resolution rather than in pure IPv4 format, thereby bypassing protections intended to prevent such access. Remediation Fix Status: Closed, completed as #357 Fix Details: - Fixed the identification of IPv6 and shared-space addresses as internal addresses. - Fixed File: POC Code

Goal Reached Thanks to every supporter — we hit 100%!

lancet SSRF Bypass: IsInternalIP fails to identify IPv6 unique-local, link-local, and encapsulated internal addresses

More from this source