mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-09-17 07:59:04 -04:00
0xdeadrelayandAlexandre Alapetite
ceb497f3c8
* Block CGNAT (RFC6598) and NAT64 (RFC6052) ranges in SSRF guard
getCurlResolveInfo() relies on PHP FILTER_FLAG_NO_PRIV_RANGE plus an explicit
PRIVATE_SUBNETS list. PHP's filter does not cover CGNAT 100.64.0.0/10
(RFC6598, used by Tailscale and some corporate/ISP networks) nor NAT64
64:ff9b::/96 (RFC6052, which maps IPv4 addresses incl. 169.254.169.254),
and neither range was in PRIVATE_SUBNETS, so an authenticated user could
still SSRF to those ranges (e.g. Tailscale peers, or NAT64-mapped cloud
metadata). Add both ranges to PRIVATE_SUBNETS.
Repro: filter_var('100.64.0.1', FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE
| FILTER_FLAG_NO_RES_RANGE) returns the IP (allowed); same for
'64:ff9b::a9fe:a9fe'.
Ref: GHSA-hcv2-vrhw-mjq8
* Minor change comments
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>