Symfony HttpClient and HttpFoundation IPv6 Transition Prefix Bypass Vulnerability

A vulnerability exists in Symfony's HttpClient and HttpFoundation components, specifically in versions 5.4.0 prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13. The issue arises because the NoPrivateNetworkHttpClient component and the IpUtils::PRIVATE_SUBNETS constant fail to account for certain IPv6 transition prefixes, such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6. This oversight allows attacker-controlled URLs to bypass private network restrictions and access private IPv4 targets, creating a server-side request forgery (SSRF) vulnerability.

Impact

Exploitation of this vulnerability leads to a server-side request forgery (SSRF) condition, where requests can be made to private network resources that should be blocked.

Reproduction

The vulnerability can be reproduced by sending a request through the NoPrivateNetworkHttpClient component with an IPv6 address that includes a private IPv4 destination, such as 6to4 or NAT64. The request will be processed as if it were going to a public address, potentially allowing access to private network resources.

Remediation

Users can upgrade to Symfony versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13, where this vulnerability has been fixed.