GHSA-cvcr-fcf6-366r: ideon: Unauthenticated SSRF in /api/proxy/image via WHATWG bracketed/hex-mapped IPv6 bypass of isSafeUrl guard
ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLEHTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ideonto a version that resolves this vulnerability.Fixed in 0.9.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can register a STREAMABLE_HTTP or SSE MCP server can exploit the issue by supplying a crafted IPv4-mapped IPv6 URL. The vulnerable server then performs an OAuth-discovery fetch to the supplied host.
What internal targets can be reached?
The documented bypass can target loopback services using http://[::ffff:7f00:1]:PORT/ and cloud metadata using http://[::ffff:a9fe:a9fe]/. These forms bypass the affected URL safety checks because of their WHATWG-canonical bracketed, hex-mapped IPv6 representation.
Which versions are affected and what is the fix?
Versions prior to 0.9.4 are affected. Upgrade to version 0.9.4, which patches the issue.