Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

Root

Cause

The SSRF validation in Craft CMS's GraphQL asset mutation relies on gethostbyname() to resolve hostnames before comparing them against a blocklist of internal IP addresses. gethostbyn() only returns IPv4 (A) records. When a hostname has only AAAA (IPv6) records, the function fails to resolve and returns the original hostname string unchanged. The blocklist check then compares that string against IPv4 addresses, always failing, so the request proceeds without restriction. This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc) [1][2].

Exploitation

Anation

An attacker must have GraphQL permissions to edit assets and create assets in the target volume. These permissions can be granted to authenticated users via a GraphQL schema access or to the Public Schema if misconfigured with write permissions [1][2]. By providing a URL that resolves only over IPv6 (e.g., a service like fd00-ec2--254.sslip.io pointing to the cloud metadata endpoint), the attacker sends a mutation such as save__Asset with that URL. The validation passes because the hostname string is not in the blocklist of IPv4 addresses. The server then fetches the content from the internal IP, stores it as an asset, and the attacker can later retrieve that asset [2][3].

Impact

Successful exploitation allows an authenticated user to make the server send HTTP requests to internal infrastructures such as AWS metadata endpoints (169.254.169.254) or other internal services. The fetched content is saved as an asset, enabling exfiltration of sensitive information and potential further compromise of cloud resources [1][2][3].

Mitigation

The vulnerability is patched in Craft CMS versions 4.16.19 and 5.8.23, where gethostbyn() is replaced by a function that also handles IPv6 resolution [1][2]. Users should Upgrade immediately; no workaround is provided for unpatch.