CyberRota Analysis
AI-GeneratedThe vulnerability exists in the webhook URL validator, which incorrectly classifies certain IPv6 transition addresses as globally routable, allowing attackers to register malicious webhooks that can exfiltrate data to internal endpoints. This issue primarily affects organizations running the non-release version of the software that includes the flawed validation logic. Security teams should prioritize remediation to prevent potential server-side request forgery (SSRF) attacks that could compromise sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns `True` even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint. The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects organisation running the HEAD.