CyberRota Analysis
AI-GeneratedFlyto2 Core versions prior to 2.28.0 are vulnerable to a server-side request forgery (SSRF) guard bypass, enabling attackers to access internal services by exploiting unblocked IPv6 addresses. This vulnerability allows unauthorized requests and 302 redirects, circumventing private IP range checks and potentially exposing sensitive internal resources. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access to their internal services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules.