imgproxy source-address guard permits CGNAT addresses
Résumé
Affected product
imgproxy's HTTP/HTTPS source-image fetcher when IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false and an untrusted party can select a source URL.
Summary
The source-address guard permits addresses in 100.64.0.0/10 because VerifySourceNetwork relies on Go's `net.IP.I...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
imgproxy のソース取得処理で、プライベートソースアドレスの許可を無効にしていても、100.64.0.0/10(CGNAT)のアドレスへの接続が許可されてしまいます。影響を受けるのは github.com/imgproxy/imgproxy で、修正版は 4.0.12 以降です。該当バージョンを使っている場合は、4.0.12 以降へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| go | github.com/imgproxy/imgproxy |
<= v4.0.11 |
>= 4.0.12 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Affected product
imgproxy's HTTP/HTTPS source-image fetcher when IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false and an untrusted party can select a source URL.
Summary
The source-address guard permits addresses in 100.64.0.0/10 because VerifySourceNetwork relies on Go's net.IP.IsPrivate(), which does not classify the RFC 6598 shared address space as private.
A request for a reachable CGNAT address therefore proceeds to the TCP dial even when the private-source-address option is disabled. This behavior predates CVE-2025-24354; that fix added the separate IsUnspecified() check for 0.0.0.0.
Technical details
In v3, security/source.go implements VerifySourceNetwork. The current implementation is fetcher/transport/generichttp/generic_http.go, where VerifySourceNetwork rejects loopback/unspecified, link-local, and ip.IsPrivate() addresses.
fetcher/transport/transport.go creates the generic HTTP transport with network verification enabled. No explicit CIDR check covers 100.64.0.0/10, so VerifySourceNetwork returns success for a CGNAT address when AllowPrivateSourceAddresses is false.
The same predicates do not reject an address in 64:ff9b::/96. That path requires a deployment-specific NAT64 translator and has not been independently verified end to end; it should be assessed separately before being included in the final advisory scope.
Preconditions
IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false.- An attacker can cause imgproxy…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY imgproxy/imgproxy