paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): close BOLA on photo-export + NAT64 SSRF in URL guard

Browse Source 
Two security advisories landed against the open #641 branch — bundling
both because they touch independent surfaces and PR #641 is the next
beta ship vehicle.

**GHSA-9v4w-jrhx-g5wr (BOLA on /admin/photo-export/:eventId/*)** —
the three /:eventId-scoped routes in `adminPhotoExport.js` (filtered,
filter-summary, export) ran `adminAuth + requirePermission(...)` but
not `requireEventOwnership`, so any non-super-admin admin/editor with
photos.view (or photos.download) could enumerate + export the photos
of events created by other admins — leaking `original_filename`,
which routinely encodes client identity. Sibling `adminPhotos.js`
applies the middleware on every :eventId route; this file was the
single drift. Reporter: Wernerina.

**GHSA-wmjx-pc37-272r (NAT64 SSRF in `isPrivateIPv6`)** — the old
implementation did naive string-prefix checks (`startsWith('fc')`,
`startsWith('fe80')`) and had zero coverage for NAT64
(`64:ff9b::/96` per RFC 6052, `64:ff9b:1::/48` per RFC 8215). On
instances with NAT64/DNS64 egress, a webhook URL like
`http://[64:ff9b:1::a9fe:a9fe]/` translated through the gateway and
reached 169.254.169.254 — exfiltrating cloud metadata (IAM creds)
into `webhook_deliveries.response_body`. Rewrote `isPrivateIPv6` to
expand the address to its canonical 8-group form, block both NAT64
prefixes, decode embedded IPv4 from IPv4-mapped (`::ffff:0:0/96`) and
deprecated IPv4-compatible (`::/96`) forms and re-check via
`isPrivateIPv4`, and fail closed on any parse failure. Reporter:
tonghuaroot.

Added 34 unit tests covering: both NAT64 prefixes in hex + mixed
dotted-quad notation, IPv4-mapped IPv6 hex + mixed, deprecated
::IPv4 form, legacy fc00::/fd00::/fe80::/::1/:: cases stay blocked,
and public IPv6 (Google/Cloudflare/Google IPv6) negative controls
stay allowed.

Refs: GHSA-9v4w-jrhx-g5wr, GHSA-wmjx-pc37-272r
This commit is contained in:
Paul Nothaft
2026-06-19 09:24:13 +02:00
parent 0d02a0124e
commit b8211e9944
3 changed files with 208 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/__tests__/utils/networkValidation.test.js
+113
View File
@@ -0,0 +1,113 @@
/**
* Tests for the SSRF guard in `networkValidation.js`.
*
* Regression coverage for GHSA-wmjx-pc37-272r — the original `isPrivateIPv6`
* was a string-prefix check that missed NAT64 (`64:ff9b::/96` per RFC 6052,
* `64:ff9b:1::/48` per RFC 8215), so a webhook URL like
* `http://[64:ff9b:1::a9fe:a9fe]/` could reach 169.254.169.254 on instances
* with NAT64/DNS64 egress.
*/
const { validateExternalUrl, isPrivateIP } = require('../../src/utils/networkValidation');
describe('validateExternalUrl — NAT64 + embedded-IPv4 SSRF', () => {
describe('NAT64 well-known prefix (RFC 6052, 64:ff9b::/96)', () => {
test.each([
['http://[64:ff9b::a9fe:a9fe]/latest/meta-data/', 'AWS metadata via NAT64 hex'],
['http://[64:ff9b::169.254.169.254]/', 'AWS metadata via NAT64 mixed notation'],
['http://[64:ff9b::7f00:1]/', 'loopback via NAT64'],
['http://[64:ff9b::a00:1]/', '10.0.0.1 via NAT64'],
])('blocks %s (%s)', (url) => {
expect(validateExternalUrl(url).valid).toBe(false);
});
});
describe('NAT64 local-use prefix (RFC 8215, 64:ff9b:1::/48)', () => {
test.each([
['http://[64:ff9b:1::a9fe:a9fe]/', 'AWS metadata via local-use NAT64'],
['http://[64:ff9b:1::169.254.169.254]/', 'AWS metadata via mixed notation'],
['http://[64:ff9b:1::7f00:1]/', 'loopback via local-use NAT64'],
['http://[64:ff9b:1:abcd::1]/', 'arbitrary host inside the /48'],
])('blocks %s (%s)', (url) => {
expect(validateExternalUrl(url).valid).toBe(false);
});
});
describe('IPv4-mapped IPv6 (::ffff:0:0/96)', () => {
test.each([
'http://[::ffff:127.0.0.1]/',
'http://[::ffff:7f00:1]/',
'http://[::ffff:169.254.169.254]/',
'http://[::ffff:a9fe:a9fe]/',
'http://[::ffff:10.0.0.1]/',
])('blocks %s', (url) => {
expect(validateExternalUrl(url).valid).toBe(false);
});
});
describe('deprecated IPv4-compatible IPv6 (::/96)', () => {
test('blocks ::127.0.0.1', () => {
expect(validateExternalUrl('http://[::127.0.0.1]/').valid).toBe(false);
});
test('blocks ::169.254.169.254', () => {
expect(validateExternalUrl('http://[::169.254.169.254]/').valid).toBe(false);
});
});
describe('existing IPv6 private-range coverage stays intact', () => {
test.each([
'http://[::1]/',
'http://[fc00::1]/',
'http://[fd12:3456:789a::1]/',
'http://[fe80::1]/',
'http://[feb0::1]/',
'http://[::]/',
])('blocks %s', (url) => {
expect(validateExternalUrl(url).valid).toBe(false);
});
});
describe('public IPv6 hosts stay allowed', () => {
test.each([
'https://[2001:4860:4860::8888]/',
'https://[2606:4700:4700::1111]/',
'https://[2a00:1450:4001:830::200e]/',
])('allows %s', (url) => {
expect(validateExternalUrl(url).valid).toBe(true);
});
});
describe('existing IPv4 private-range coverage stays intact', () => {
test.each([
'http://127.0.0.1/',
'http://10.0.0.1/',
'http://172.16.0.1/',
'http://192.168.0.1/',
'http://169.254.169.254/',
'http://0.0.0.0/',
])('blocks %s', (url) => {
expect(validateExternalUrl(url).valid).toBe(false);
});
});
describe('blocked hostnames', () => {
test.each([
'http://localhost/',
'http://metadata.google.internal/',
])('blocks %s', (url) => {
expect(validateExternalUrl(url).valid).toBe(false);
});
});
describe('fail-closed parsing', () => {
test('isPrivateIP returns true for non-string', () => {
expect(isPrivateIP(null)).toBe(true);
expect(isPrivateIP(undefined)).toBe(true);
expect(isPrivateIP(42)).toBe(true);
});
test('invalid URLs are rejected', () => {
expect(validateExternalUrl('not a url').valid).toBe(false);
expect(validateExternalUrl('').valid).toBe(false);
});
});
});
backend/src/routes/adminPhotoExport.js
+4 -3
View File
@@ -9,6 +9,7 @@ const { body, query, validationResult } = require('express-validator');
const { db, withRetry } = require('../database/db');
const { adminAuth } = require('../middleware/auth');
const { requirePermission } = require('../middleware/permissions');
const { requireEventOwnership } = require('../middleware/ownership');
const { PhotoFilterBuilder } = require('../utils/photoFilterBuilder');
const { PhotoExportService } = require('../services/photoExportService');
@@ -18,7 +19,7 @@ const exportService = new PhotoExportService();
* GET /admin/photos/:eventId/filtered
* Get filtered photos with pagination
*/
router.get('/:eventId/filtered', adminAuth, requirePermission('photos.view'), [
router.get('/:eventId/filtered', adminAuth, requirePermission('photos.view'), requireEventOwnership, [
query('min_rating').optional().isFloat({ min: 0, max: 5 }),
query('max_rating').optional().isFloat({ min: 0, max: 5 }),
query('has_likes').optional().isBoolean(),
@@ -132,7 +133,7 @@ router.get('/:eventId/filtered', adminAuth, requirePermission('photos.view'), [
* GET /admin/photos/:eventId/filter-summary
* Get just the summary counts for filter UI
*/
router.get('/:eventId/filter-summary', adminAuth, requirePermission('photos.view'), async (req, res) => {
router.get('/:eventId/filter-summary', adminAuth, requirePermission('photos.view'), requireEventOwnership, async (req, res) => {
try {
const eventId = parseInt(req.params.eventId);
@@ -154,7 +155,7 @@ router.get('/:eventId/filter-summary', adminAuth, requirePermission('photos.view
* POST /admin/photos/:eventId/export
* Export selected or filtered photos
*/
router.post('/:eventId/export', adminAuth, requirePermission('photos.download'), [
router.post('/:eventId/export', adminAuth, requirePermission('photos.download'), requireEventOwnership, [
body('photo_ids').optional().isArray(),
body('photo_ids.*').optional().isInt(),
body('filter').optional().isObject(),
backend/src/utils/networkValidation.js
+91 -8
View File
@@ -63,16 +63,99 @@ function isPrivateIPv4(ip) {
return false;
}
/**
* Expand an IPv6 address (including mixed dotted-quad notation) into its
* canonical 8-group form, each group a 4-char lowercase hex string. Returns
* null on any parse failure so callers can fail closed.
*/
function expandIPv6(ip) {
if (typeof ip !== 'string' || !net.isIPv6(ip)) return null;
let normalized = ip.toLowerCase();
// Mixed notation: trailing dotted-quad (e.g. ::ffff:192.0.2.1, 64:ff9b::169.254.169.254)
if (normalized.includes('.')) {
const lastColon = normalized.lastIndexOf(':');
const tail = normalized.slice(lastColon + 1);
const parts = tail.split('.').map(p => Number(p));
if (parts.length !== 4 || parts.some(p => !Number.isInteger(p) || p < 0 || p > 255)) {
return null;
}
const hex1 = ((parts[0] << 8) | parts[1]).toString(16).padStart(4, '0');
const hex2 = ((parts[2] << 8) | parts[3]).toString(16).padStart(4, '0');
normalized = normalized.slice(0, lastColon + 1) + hex1 + ':' + hex2;
}
let groups;
const dcIdx = normalized.indexOf('::');
if (dcIdx === -1) {
groups = normalized.split(':');
if (groups.length !== 8) return null;
} else {
const left = normalized.slice(0, dcIdx);
const right = normalized.slice(dcIdx + 2);
const leftGroups = left === '' ? [] : left.split(':');
const rightGroups = right === '' ? [] : right.split(':');
const missing = 8 - leftGroups.length - rightGroups.length;
if (missing < 0) return null;
groups = [...leftGroups, ...Array(missing).fill('0'), ...rightGroups];
}
const padded = groups.map(g => (/^[0-9a-f]{1,4}$/.test(g) ? g.padStart(4, '0') : null));
if (padded.some(g => g === null)) return null;
return padded;
}
function ipv4FromLow32(g6, g7) {
const hi = parseInt(g6, 16);
const lo = parseInt(g7, 16);
return `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
}
function isPrivateIPv6(ip) {
const lower = ip.toLowerCase();
// ::1 loopback
if (lower === '::1' || lower === '0000:0000:0000:0000:0000:0000:0000:0001') return true;
// fc00::/7 — unique local
if (lower.startsWith('fc') || lower.startsWith('fd')) return true;
// fe80::/10 — link-local
if (lower.startsWith('fe80')) return true;
const groups = expandIPv6(ip);
// Fail closed: anything we cannot parse, we treat as private.
if (!groups) return true;
const [g0, g1, g2, g3, g4, g5, g6, g7] = groups;
// :: unspecified
if (lower === '::') return true;
if (groups.every(g => g === '0000')) return true;
// ::1 loopback
if (g0 === '0000' && g1 === '0000' && g2 === '0000' && g3 === '0000'
&& g4 === '0000' && g5 === '0000' && g6 === '0000' && g7 === '0001') return true;
// fc00::/7 — unique-local (first byte 0xFC or 0xFD)
const firstByte = parseInt(g0.slice(0, 2), 16);
if (firstByte === 0xfc || firstByte === 0xfd) return true;
// fe80::/10 — link-local (first 10 bits cover fe80..febf)
const firstShort = parseInt(g0, 16);
if (firstShort >= 0xfe80 && firstShort <= 0xfebf) return true;
// 64:ff9b::/96 — NAT64 well-known prefix (RFC 6052). Translated to IPv4 at
// the NAT64 gateway, so a URL like http://[64:ff9b::a9fe:a9fe]/ reaches
// 169.254.169.254. Block the whole prefix — no legitimate outbound use.
if (g0 === '0064' && g1 === 'ff9b'
&& g2 === '0000' && g3 === '0000' && g4 === '0000' && g5 === '0000') {
return true;
}
// 64:ff9b:1::/48 — NAT64 local-use prefix (RFC 8215). Same reasoning.
if (g0 === '0064' && g1 === 'ff9b' && g2 === '0001') return true;
// ::ffff:0:0/96 — IPv4-mapped IPv6 (RFC 4291). Decode the embedded IPv4
// and re-run through the v4 check so `::ffff:127.0.0.1` and the literal
// hex form `::ffff:7f00:1` both get caught.
if (g0 === '0000' && g1 === '0000' && g2 === '0000' && g3 === '0000'
&& g4 === '0000' && g5 === 'ffff') {
return isPrivateIPv4(ipv4FromLow32(g6, g7));
}
// ::/96 — deprecated IPv4-compatible IPv6. Excludes the all-zero
// unspecified address (handled above). Decode + re-check.
if (g0 === '0000' && g1 === '0000' && g2 === '0000' && g3 === '0000'
&& g4 === '0000' && g5 === '0000' && !(g6 === '0000' && g7 === '0000')) {
return isPrivateIPv4(ipv4FromLow32(g6, g7));
}
return false;
}