Executive brief
HomeBox is a home inventory management system that allows users to configure notification services. An authenticated user on an instance using DNS64/NAT64 networking can exploit incomplete validation of IPv6 addresses to craft requests that access cloud metadata, localhost services, or internal hosts through the notifier feature. The notifier test endpoint returns delivery results that may disclose temporary credentials or other sensitive metadata from accessed services.
Technical details
The SSRF protection in the notifier URL validation (backend/internal/sys/validate/notifier_url.go) fails to recognize IPv4 addresses embedded in NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, allowing an authenticated attacker to submit generic:// notifier URLs targeting internal resources. On instances with NAT64/DNS64 egress, the gateway translates these IPv6 destinations to cloud metadata or internal IPv4 hosts; the notifier test path (POST /v1/notifiers/test) returns delivery results through Shoutrrr that can leak accessed metadata. Without NAT64 egress, the addresses are non-routable but still incorrectly pass validation.
Affected products
- HomeBox HomeBox before 0.26.0
Timeline
- 2026-09-21: disclosed
- 2026-06-10: patched: Fix committed with DNS64Nets configuration support