Executive brief
CC: Tweaked is a Minecraft mod that adds programmable computers and automation to the game. A security flaw allows players to bypass network restrictions and send unauthorized requests to private internal services, such as databases or cloud management interfaces. This could lead to the exposure of sensitive internal data or unauthorized control over the server's hosting environment, especially on cloud platforms like AWS and GCP.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in CC: Tweaked's HTTP API (http.request and http.websocket) due to insufficient validation of IPv6 addresses. While the mod attempts to block private network ranges using Java's InetAddress classification methods, it fails to account for the NAT64 well-known prefix (64:ff9b::/96). An attacker capable of executing Lua code within the mod can address internal IPv4 services by encoding them as NAT64 addresses (e.g., http://[64:ff9b::<ipv4-as-hex>]/). This bypass is effective on servers deployed in environments with NAT64 routing, such as IPv6-only subnets on AWS or GCP. The issue is resolved in version 1.119.0 by explicitly checking for the NAT64 prefix in the address filtering logic.
Affected products
- cc-tweaked CC: Tweaked < 1.119.0
Timeline
- 2026-05-18: advisory: Original GitHub security advisory published
- 2026-07-21: disclosed: CVE-2026-47695 published to NVD
- 2026-07-21: patched: Version 1.119.0 released to fix the issue