imgproxy で CGNAT アドレスへの内部アクセスが許可される
Summary
imgproxy のソース取得処理で、プライベートソースアドレスの許可を無効にしていても、100.64.0.0/10(CGNAT)のアドレスへの接続が許可されてしまいます。影響を受けるのは github.com/imgproxy/imgproxy で、修正版は 4.0.12 以降です。該当バージョンを使っている場合は、4.0.12 以降へ更新してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
imgproxy のソース取得処理で、プライベートソースアドレスの許可を無効にしていても、100.64.0.0/10(CGNAT)のアドレスへの接続が許可されてしまいます。影響を受けるのは github.com/imgproxy/imgproxy で、修正版は 4.0.12 以降です。該当バージョンを使っている場合は、4.0.12 以降へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| go | github.com/imgproxy/imgproxy |
<= v4.0.11 |
>= 4.0.12 |
Original description The description as published by the source.
Affected product
imgproxy's HTTP/HTTPS source-image fetcher when IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false and an untrusted party can select a source URL.
Summary
The source-address guard permits addresses in 100.64.0.0/10 because VerifySourceNetwork relies on Go's net.IP.IsPrivate(), which does not classify the RFC 6598 shared address space as private.
A request for a reachable CGNAT address therefore proceeds to the TCP dial even when the private-source-address option is disabled. This behavior predates CVE-2025-24354; that fix added the separate IsUnspecified() check for 0.0.0.0.
Technical details
In v3, security/source.go implements VerifySourceNetwork. The current implementation is fetcher/transport/generichttp/generic_http.go, where VerifySourceNetwork rejects loopback/unspecified, link-local, and ip.IsPrivate() addresses.
fetcher/transport/transport.go creates the generic HTTP transport with network verification enabled. No explicit CIDR check covers 100.64.0.0/10, so VerifySourceNetwork returns success for a CGNAT address when AllowPrivateSourceAddresses is false.
The same predicates do not reject an address in 64:ff9b::/96. That path requires a deployment-specific NAT64 translator and has not been independently verified end to end; it should be assessed separately before being included in the final advisory scope.
Preconditions
IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false.- An attacker can cause imgproxy…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY imgproxy/imgproxy