Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Python: server_url_validator allows Azure WireServer (168.63.129.16) and IPv6-embedded IPv4 forms (NAT64/6to4/Teredo)

Aperta
  • Qualcosa non va?
#14,240 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
api, security

Direzione di ricerca

Inizia in semantic_kernel.connectors.openapi_plugin.server_url_validator, all'interno di validate_server_url, quindi esamina try_categorize_non_public_address e gli helper per la classificazione IPv4/IPv6. Usa gli indirizzi di riproduzione e il comportamento previsto nell'issue come verifiche; il lavoro è completo quando Azure WireServer viene bloccato e le forme NAT64, 6to4 e Teredo vengono decodificate prima della classificazione.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

server_url_validator is the default SSRF guard for OpenAPI plugin calls (allow_private_network_access defaults to False), and it classifies IPv4 by explicit octet ranges and IPv6 by a short list of properties. Two categories fall outside both:

  • 168.63.129.16 — Azure's WireServer / platform channel, reachable from every Azure VM. It's a publicly routable address, so none of the _try_classify_ipv4 branches match it.
  • IPv6 addresses that carry an IPv4 target inside them. _try_classify_ipv6 unwraps ::ffff: via ipv4_mapped, but NAT64, 6to4 and Teredo encodings aren't decoded.

The URL an OpenAPI plugin ends up calling is influenced by the model (server variables, path parameters), which is what makes this the SSRF surface the module exists for.

To Reproduce
import asyncio
from semantic_kernel.connectors.openapi_plugin.server_url_validator import validate_server_url

asyncio.run(validate_server_url("https://168.63.129.16/machine/"))            # returns
asyncio.run(validate_server_url("https://[64:ff9b::169.254.169.254]/latest/meta-data/"))  # returns

Full sweep on main @ 7d885dd:

address result category reported
169.254.169.254 (AWS/GCP/Azure/OCI/DO IMDS) blocked link-local
169.254.170.2 (AWS ECS task creds) blocked link-local
169.254.170.23 (AWS EKS Pod Identity) blocked link-local
169.254.42.42 (Scaleway) blocked link-local
100.100.100.200 (Alibaba) blocked carrier-grade NAT
192.0.0.192 (Oracle Cloud Classic) blocked reserved
168.63.129.16 (Azure WireServer) allowed —
IPv6 form result
::ffff:169.254.169.254 (IPv4-mapped) blocked
::1, fd00:ec2::254 blocked
64:ff9b::169.254.169.254 (NAT64 well-known, RFC 6052) allowed
2002:a9fe:a9fe:: (6to4, RFC 3056) allowed
2001:0:4136:e378:8000:63bf:3fff:fdd2 (Teredo, RFC 4380) allowed
Expected behavior

168.63.129.16 blocked regardless of the private-range classification, and IPv6 forms carrying an embedded IPv4 decoded to that IPv4 before classification.

The Azure one can't be caught by range logic — it needs an explicit metadata denylist, checked before allow_private_network_access returns early, since "let me reach my own network" and "let me reach the host agent's credential endpoint" aren't the same request.

NAT64 needs the 64:ff9b::/96 and 64:ff9b:1::/48 prefixes decoded per RFC 6052 §2.2; 6to4 takes the IPv4 from bits 16–47; Teredo's is the low 32 bits XOR'd with all-ones.

Platform
  • OS: Linux
  • Python: 3.10.12
  • Semantic Kernel: main @ 7d885dd (python)
Additional context

Reachability varies by deployment — NAT64 needs a gateway on the path, and 6to4/Teredo relays are largely retired, so those three are defence-in-depth rather than universally exploitable. 168.63.129.16 is different: it is directly reachable on any Azure VM with no special network setup, which is where this repo's users are most likely to be running.

The IPv4-mapped unwrapping in try_categorize_non_public_address is already the right shape for the IPv6 side; the other encodings would slot in next to it.

Lingua principale
C#
Stelle
28.6k
Fork
4.8k
Merge medio
13h 24m
PR unite (30g)
11

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/semantic-kernel

Tutte le issue di microsoft/semantic-kernel

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.