Open aydinnyunus opened 5 months ago
Hi Team,
I found possible SSRF and Open Redirect Vulnerability on the https://github.com/flannel-io/flannel/blob/master/pkg/backend/wireguard/wireguard_network.go#L127
You can find the POC on the following Playground link. The IsPrivate function did not check all of the internal URLs. So you can use IsLinkLocalUnicast, IsLinkLocalMulticast, IsLoopback functions to do that.
Hi Team,
I found possible SSRF and Open Redirect Vulnerability on the https://github.com/flannel-io/flannel/blob/master/pkg/backend/wireguard/wireguard_network.go#L127
You can find the POC on the following Playground link. The IsPrivate function did not check all of the internal URLs. So you can use IsLinkLocalUnicast, IsLinkLocalMulticast, IsLoopback functions to do that.