🛡️ Sentinel: [HIGH] Fix SSRF bypass via ISATAP tunneling addresses#74
🛡️ Sentinel: [HIGH] Fix SSRF bypass via ISATAP tunneling addresses#74ManupaKDU wants to merge 1 commit into
Conversation
Python's `ipaddress` module evaluates ISATAP addresses (e.g., `2000::5efe:127.0.0.1`) as `is_global = True` and does not automatically unwrap the embedded IPv4 address. This allows an attacker to bypass SSRF protections by encapsulating a restricted, private, or loopback IPv4 address inside an ISATAP IPv6 address. This commit manually unwraps the IPv4 address from the ISATAP format by checking the 32-bit ISATAP identifier (`0x00005efe` or `0x02005efe`) and then validates the underlying IPv4 address against the SSRF rules. Tests have been added to verify that ISATAP bypasses are properly blocked. Co-authored-by: ManupaKDU <95234271+ManupaKDU@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: HIGH
💡 Vulnerability: Server-Side Request Forgery (SSRF) bypass via ISATAP tunneling addresses. Python's
ipaddressmodule evaluates ISATAP addresses asis_global = Truewithout un-wrapping the embedded IPv4 address.🎯 Impact: An attacker could bypass SSRF protections and scan or interact with restricted internal network addresses (e.g. 127.0.0.1 or 192.168.x.x) by encapsulating them in an ISATAP IPv6 address.
🔧 Fix: Extracted the 32-bit ISATAP identifier to determine if the address is an ISATAP address (
0x00005efeor0x02005efe). If so, the embedded IPv4 address is manually extracted and validated against the SSRF blocklist.✅ Verification: Run
python3 -m unittest test_testping1.pyto run the updated test suite, which includes a test explicitly for this bypass vector.PR created automatically by Jules for task 2214781773707707780 started by @ManupaKDU