SSRF Bypass in ssrfcheck - fails to classify reserved IP address space as invalid (Snyk)

[felippe-regazio]

Bypass Report: https://gist.github.com/lirantal/2976840639df824cb3abe60d13c65e04

Must patch a new version to address a fix to the IP Bypass informed in the report above.

[lirantal]

Hi @felippe-regazio, sounds good! can you please enable private vulnerability reporting on the repo's settings? See here how to do it if you can't easily find: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability

Once you do it, I can post the report there and then you can publish it and request a CVE officially through GitHub which handles all of it.

[felippe-regazio]

Hello @lirantal, of course, I have enabled private vulnerability reporting. Also I addressed a fix which is already merged and published the version 1.2.0. You can do a new test with the version 1.2.0 or running:

npx ssrfcheck https://239.255.255.250:8080/whatever

I really appreciated your report, many thanks!

[lirantal]

Thank you so much for enabling that Felippe and appreciate the fix already deployed, this makes it now super easy to handle the official CVE report.

I've submitted it here: https://github.com/felippe-regazio/ssrfcheck/security/advisories/GHSA-p4hc-9pjh-55c8

Given that we've now both fixed and released a new version, all you have to do is click the following on the report:

1. Accept the report
2. Publish it
3. Request a CVE