The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).
An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.
The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.
" } ], "value": "The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources." } ], "impacts": [ { "capecId": "CAPEC-12", "descriptions": [ { "lang": "en", "value": "CAPEC-12 Server Side Request Forgery" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "format": "SSVC", "other": { "content": { "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "Supplier", "timestamp": "2026-10-19T22:15:01Z", "version": "2.0.3" }, "type": "SSVC" }, "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-10-19T22:19:50.011Z" }, "references": [ { "name": "Security patch", "tags": [ "patch" ], "url": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.
" } ], "value": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges." } ], "title": "MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()", "x_gcve": [ { "extensions": { "bcp-05-x-01": { "ai_annotations": [ { "ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [ { "gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama" } ], "review_status": "partial", "scope": "record", "tags": [ "ai-computer-assisted:llm-generated", "ai-computer-assisted:classification" ] } ] }, "bcp-05-x-02": { "x_patch2vuln": { "assumptions": [ "PR:L assumes that creating or modifying a MISP attribute to trigger the html_to_markdown expansion module requires authenticated access. MISP typically enforces authentication for attribute operations, but the patch does not explicitly state the authentication model.", "SC:H assumes the MISP server can reach internal services (e.g., cloud metadata at 169.254.169.254, internal admin panels, or CGNAT infrastructure) and that the responses are returned to the attacker via the Markdown conversion output. The actual impact depends on the server's network topology.", "The exact affected version range is not specified in the patch. The nearest tag is v3.0.13 with 139 commits after the fix, but the precise release containing the fix is not identified.", "CAPEC-12 is selected as the closest match; no alternative CAPEC more precisely describes an SSRF via incomplete IP-range validation in a URL-fetching module.", "The patch does not indicate whether the module follows redirects to additional unblocked ranges; MAX_REDIRECTS is set to 10, and the redirect target validation is not shown in this patch. If redirect targets are not re-validated, the SSRF surface may be broader than what this patch addresses." ], "capecRationale": [ { "capecId": "CAPEC-12", "rationale": "The patch directly addresses an SSRF condition: the application fetches a URL on behalf of the user, and the validation logic failed to block requests to internal and restricted IP ranges. An attacker crafts a URL with a blocked-range IP (e.g., http://0.0.0.0/admin or http://[fe80::1]/) to cause the MISP server to issue a request to an internal service. This is the canonical CAPEC-12 pattern. No uncertainty in this mapping." } ], "commit": "98a1c2c2f297665dd8d4609e9cd644007a57516b", "confidence": "medium", "credits": [ { "lang": "en", "type": "remediation developer", "value": "elhoim" }, { "lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)" } ], "cvssRationale": "AV:N: The vulnerable URL is supplied via a MISP attribute over the network. AC:L: Crafting a URL with a blocked-range IP is straightforward; no race or special timing is needed. AT:N: No manipulation of the target service is required. PR:L: Creating or modifying a MISP attribute that triggers the expansion module requires authenticated access (assumed; MISP typically requires authentication for attribute operations). UI:N: No victim interaction beyond the initial attribute creation is needed. VC:N, VI:N, VA:N: The MISP server itself is not compromised; it is used as a proxy. SC:H: The SSRF allows reading responses from internal services (e.g., cloud metadata endpoints, internal admin panels), representing a high confidentiality impact on the target system. SI:N, SA:N: The module performs a GET-style fetch for HTML-to-Markdown conversion; no evidence of write or security-impact on the target.", "fixSummary": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.", "generatedAt": "2026-10-19T22:15:01.979194Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": { "rankings": [ { "agreementScore": 11, "assumptionCount": 5, "confidence": "medium", "model": "qwen3.8:27b", "score": 7 } ], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required." }, "patchSha256": "a1b0755b91ddfee8869bba03e3d5eb00ffedd8e753d6d03e40c059d056567b28", "patchSummary": "In misp_modules/modules/expansion/html_to_markdown.py, five new ipaddress.ip_network() entries are added to the BLOCKED_RANGES list: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. In tests/test_html_to_markdown.py, two new test methods are added: test_blocks_unspecified_shared_ula_and_link_local_literals verifies that is_safe_url() returns False for literal URLs using each blocked range (including IPv4-mapped IPv6 forms), and test_blocks_hostnames_resolving_to_ula_addresses verifies that a hostname resolving to an fc00::/7 address is rejected.", "patchTruncated": false, "patches": [ { "commit": "98a1c2c2f297665dd8d4609e9cd644007a57516b", "date": "Fri, 25 Sep 2026 22:15:46 +0000", "patchSha256": "a1b0755b91ddfee8869bba03e3d5eb00ffedd8e753d6d03e40c059d056567b28", "source": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch", "sourceUrl": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch", "subject": "fix: [html_to_markdown] block unspecified, shared, ULA and" } ], "source": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch", "ssvc": { "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "Supplier", "timestamp": "2026-10-19T22:15:01Z", "version": "2.0.3" }, "subject": "fix: [html_to_markdown] block unspecified, shared, ULA and", "tagVersionBoundary": { "commits_after_fix": 139, "repository": "https://github.com/misp/misp-modules", "tag": "v3.0.13", "version": "3.0.13", "version_type": "semver" }, "weaknessRationale": [ { "cweId": "CWE-918", "rationale": "The html_to_markdown module fetches a user-supplied URL server-side. The incomplete IP range allow/block list permitted requests to internal, link-local, and otherwise restricted network destinations, constituting a classic SSRF." }, { "cweId": "CWE-20", "rationale": "The is_safe_url() function's BLOCKED_RANGES list was incomplete, failing to validate against all non-routable and internally significant IP address ranges. This is the root-cause input validation deficiency enabling the SSRF." } ] } }, "bcp-05-x-03": { "x_timeline": { "events": [ { "description": "Corrective change authored (98a1c2c2f297665dd8d4609e9cd644007a57516b): fix: [html_to_markdown] block unspecified, shared, ULA and", "id": "evt-fix-developed-1", "references": [ "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch" ], "timestamp": "2026-09-25T22:15:46Z", "type": "fix-developed" } ] } } }, "recordType": "advisory", "vulnId": "GCVE-1-2026-20287" } ] } } }