Executive brief
CC: Tweaked is a Minecraft mod that adds programmable computers and automation features. Prior to version 1.120.0, the mod's server-side request filter could be bypassed on dual-stack (IPv6+IPv4) servers using RFC 8215 NAT64, allowing any player with code execution to reach internal services like loopback addresses, private networks, and cloud metadata endpoints that should be blocked. This could lead to unauthorized access to sensitive internal systems.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in AddressPredicate.java. The root cause is an incomplete blocklist in the PrivatePattern.matches() function: a prior fix (for GHSA-5jh9-2h63-pw4q) blocked the RFC 6052 NAT64 prefix (64:ff9b::/96) but overlooked the RFC 8215 locally-assigned prefix (64:ff9b:1::/96). On a dual-stack NAT64 server, an unauthenticated user executing Lua code can encode private IPv4 addresses into the RFC 8215 range (e.g., 127.0.0.1 becomes 64:ff9b:1::7f00:1) and pass them to http.request or http.websocket to bypass all existing checks. The attack requires the ability to execute Lua code on the server (a common feature on public/shared ComputerCraft instances) and a server configured with RFC 8215 NAT64. Fixed in version 1.120.0 by adding NAT64_RFC8215_RANGE to the blocklist.
Affected products
- CC-Tweaked CC-Tweaked <1.120.0
Timeline
- 2026-06-15: disclosed: GitHub security advisory published
- 2026-06-15: patched: Fixed in version 1.120.0
- 2026-08-27: other: CVE-2026-55758 published