Executive brief
The dssrf library, a tool used by developers to prevent Server-Side Request Forgery (SSRF) attacks, fails to properly validate IPv6 addresses. An attacker can bypass security checks by using various IPv6 formats to access internal services or sensitive metadata that should be restricted. This could lead to unauthorized access to internal infrastructure or private data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the dssrf library due to incomplete filtering of IPv6 addresses in the is_url_safe function. While the library successfully blocks restricted IPv4 addresses, its IPv6 validation logic is fundamentally flawed, allowing all categories of IPv6 addresses (including loopback, link-local, ULA, and IPv4-mapped addresses) to pass as 'safe'. An attacker can exploit this by providing specially crafted IPv6 URLs to reach internal network resources or cloud metadata services (IMDS). The vulnerability is addressed in version 1.0.3.
Affected products
- HackingRepo dssrf < 1.0.3
Timeline
- 2026-04-27: disclosed
- 2026-05-06: advisory
- 2026-05-06: patched