Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validate_url to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
microsoft:ufo
References 3
https://github.com/microsoft/UFO/security/advisories/GHSA-7hrg-r8xr-p8gr
https://github.com/microsoft/UFO/security/advisories/GHSA-7hrg-r8xr-p8gr
https://github.com/microsoft/UFO/commit/96983c73ed09e884a5f1d7ff8936c953b234b684
https://github.com/microsoft/UFO/commit/96983c73ed09e884a5f1d7ff8936c953b234b684
https://github.com/microsoft/UFO/releases/tag/v3.0.8
https://github.com/microsoft/UFO/releases/tag/v3.0.8