CyberRota Analysis
AI-GeneratedThe vulnerability affects NLTK versions 3.9.4 and the current development branch, specifically in the `validate_network_url()` function, which fails to properly reject IP addresses in the RFC 6598 shared address space. This oversight allows an attacker to manipulate URLs, potentially leading to unauthorized access to internal resources via Server-Side Request Forgery (SSRF). Organizations using NLTK for network operations should prioritize patching this vulnerability to mitigate risks related to confidentiality exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.