CyberRota Analysis
AI-GeneratedCC: Tweaked, a Minecraft mod, is vulnerable to a bypass of its HTTP API protections against server-side request forgery (SSRF) on IPv6-capable servers using NAT64. Attackers with the ability to execute Lua code can exploit this vulnerability to access internal IPv4 services by manipulating the HTTP requests. Organizations deploying CC-Tweaked in environments with NAT64 routing, particularly on cloud platforms like AWS and GCP, should prioritize upgrading to version 1.119.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.