MISP misp-modules Server-Side Request Forgery Protection Bypass Vulnerability

A Server-Side Request Forgery (SSRF) protection bypass vulnerability has been identified in the html_to_markdown expansion module of MISP misp-modules. This vulnerability arises because the module's IP address validation does not properly normalize IPv4-mapped IPv6 addresses before checking them against blocked ranges. As a result, an authenticated attacker can exploit this flaw by sending requests to loopback, private, link-local, or other restricted IP ranges, potentially accessing internal services or metadata. The vulnerability has been addressed by normalizing IPv4-mapped IPv6 addresses to their IPv4 equivalents before applying range checks, and by rejecting URLs without valid hostnames.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to bypass SSRF protections and access services on the loopback interface, internal network, or link-local network. This could expose internal web services, administrative interfaces, or cloud instance metadata, with any retrieved content potentially returned to the attacker in Markdown format.

Reproduction

To reproduce this vulnerability, an authenticated user can invoke the html_to_markdown module and supply an IPv4-mapped IPv6 address that points to a restricted IP range, such as loopback or link-local addresses. Alternatively, a hostname that resolves to an IPv4-mapped IPv6 address can be used. The module will treat these addresses as IPv6, bypassing the blocked IPv4 range checks and allowing access to internal services or metadata.

Remediation

Users are advised to update to the latest version of MISP misp-modules, where this vulnerability has been fixed. Instructions for updating can be found in the MISP documentation.