Description
WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud metadata services and loopback interfaces.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | — | — |
References
- GitHub Security Advisory (GHSA-88jm-rxg9-3v5r) vendor-advisory
- VulnCheck Advisory: WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address third-party-advisory