CyberRota Analysis
AI-GeneratedThe vulnerability affects the safeurl library, specifically in its handling of server-side request forgery (SSRF) protections related to IPv6 addresses. Prior to version 0.2.4, certain IPv6 ranges were incorrectly classified as public, allowing attackers to bypass SSRF checks and potentially access sensitive internal resources. Organizations using safeurl with IPv6 enabled should prioritize updating to version 0.2.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.