Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flyto-core | pip | <= 2.26.2 | 2.26.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in flyto-core's URL validation logic. The root cause lies in the is_private_ip function within src/core/utils.py. This function was responsible for checking if a given IP address belongs to a private network range to prevent requests to internal services.
The vulnerability existed because is_private_ip only checked the literal IP address provided to it. It did not account for IPv6 transition mechanisms that can embed IPv4 addresses within IPv6 addresses. Attackers could craft URLs using special IPv6 formats like IPv4-mapped (::ffff:a.b.c.d), 6to4 (2002::/16), or NAT64 (64:ff9b::/96) to encapsulate private IPv4 addresses (e.g., 127.0.0.1 for loopback or 169.254.169.254 for cloud metadata services). The is_private_ip function would see the outer IPv6 address, which is not in its list of private ranges, and incorrectly approve it.
This flawed validation was used by the validate_url_ssrf function, which in turn was called by various modules like http.get. When a user-provided URL was passed to these modules, the validation could be bypassed, allowing the application to make requests to internal services on behalf of the attacker and return the response, resulting in a read SSRF.
The patch addresses this by introducing a new function, _extract_embedded_ipv4, which inspects an IPv6 address for any embedded IPv4 address. The is_private_ip function was updated to use this new helper. It now checks both the original IP and any embedded IPv4 address against the private IP ranges, effectively closing the bypass.
is_private_ipsrc/core/utils.py
validate_url_ssrfsrc/core/utils.py
validate_url_with_env_configsrc/core/utils.py