External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: block hex IPv4-mapped IPv6 in SSRF guard

Browse Source 
The WHATWG URL parser canonicalizes dotted IPv4-mapped IPv6 literals
(e.g. ::ffff:127.0.0.1) to hex form (::ffff:7f00:1). The SSRF guard
only checked the dotted form, so hex literals bypassed the private-IP
classifier and allowed access to loopback, cloud metadata, and RFC1918
addresses.

Decode hex IPv4-mapped suffixes to dotted IPv4 before the private-range
check.

Reported-by: tonghuaroot
This commit is contained in:
SnapOtter
2026-06-06 20:27:48 +08:00
parent 3b84fab765
commit f64cbdda4e
2 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/lib/ssrf.ts
+13 -1
View File
@@ -33,7 +33,19 @@ function isPrivateIPv6(ip: string): boolean {
if (normalized.startsWith("64:ff9b:")) return true;
if (normalized.includes("::ffff:")) {
const v4 = normalized.split("::ffff:")[1];
if (v4 && isPrivateIPv4(v4)) return true;
if (v4) {
if (v4.includes(".")) {
if (isPrivateIPv4(v4)) return true;
} else {
const m = v4.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
if (m) {
const hi = parseInt(m[1], 16);
const lo = parseInt(m[2], 16);
const dotted = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
if (isPrivateIPv4(dotted)) return true;
}
}
}
}
return false;
}