public/once-campfire
1
0 Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-10-31 09:24:05 +09:00
Code Issues Packages Projects Releases Wiki Activity

Block IPv6 SSRF bypass via ipv4_compat addresses (#153)

Browse Source 
Adds ipv4_mapped? and ipv4_compat? checks to PrivateNetworkGuard.private_ip?
to block SSRF bypass attempts using IPv6 address formats like:
- ::ffff:169.254.169.254 (IPv4-mapped)
- ::169.254.169.254 (IPv4-compatible)

These formats could previously bypass the link_local? check since Ruby
treats them as IPv6 addresses, not IPv4.

Ref: HackerOne #3481701
This commit is contained in:
Jeremy Daer authored and GitHub committed 2025-12-31 13:01:43 -08:00
1 parent 53e36a16ea
commit e983e3f79f
2 files changed
+90 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

lib/restricted_http/private_network_guard.rb
+1 -1
View File
@@ -16,7 +16,7 @@ module RestrictedHTTP
def private_ip?(ip)
IPAddr.new(ip).then do |ipaddr|
ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? || ipaddr.ipv4_mapped? || LOCAL_IP.include?(ipaddr)
ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? || ipaddr.ipv4_mapped? || ipaddr.ipv4_compat? || LOCAL_IP.include?(ipaddr)
end
rescue IPAddr::InvalidAddressError
true