EUVD-2026-45407
GHSA-vf62-q3j8-cj9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SSRF requiring low-privilege auth; no meaningful availability impact from requests to unpopulated RFC 2544 benchmark addresses.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Impacted is the function isPrivateOrRestrictedIP of the file pkg/tools/integration/web.go of the component web_fetch. This manipulation causes server-side request forgery. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the server to issue outbound HTTP requests to the RFC 2544 benchmark address range (198.18.0.0/15), which was omitted from the private/restricted IP blocklist in the isPrivateOrRestrictedIP function. The CVSS 4.0 score of 2.1 reflects the narrow impact scope and authentication requirement (PR:L). A publicly available proof-of-concept exists via GitHub issue #3077, and an upstream patch has been committed but no tagged release version has been independently confirmed as shipping the fix.
Technical ContextAI
PicoClaw is a Go-language application by Sipeed. Its web_fetch integration component (file pkg/tools/integration/web.go) includes a function isPrivateOrRestrictedIP that validates destination IP addresses before issuing outbound HTTP requests, implementing a server-side SSRF protection layer. The root cause (CWE-918: Server-Side Request Forgery) is an incomplete blocklist: the function correctly blocked RFC 1918 private ranges (10.x, 172.16-31.x, 192.168.x) and CGNAT (100.64.0.0/10) but omitted the RFC 2544 network testing benchmark range 198.18.0.0/15. The patch (commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405, PR #3085) adds the condition (ip4[0] == 198 && ip4[1] >= 18 && ip4[1] <= 19) to close the gap. The affected CPE is cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:* covering all versions up to and including 0.2.9.
RemediationAI
Apply the upstream patch from commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 available via GitHub pull request #3085 (https://github.com/sipeed/picoclaw/pull/3085); this adds the 198.18.0.0/15 RFC 2544 benchmark range to the isPrivateOrRestrictedIP blocklist. Note that no specifically tagged release version containing this fix has been independently confirmed - operators should build from the patched commit. As a compensating network-level control, block outbound egress from the PicoClaw host to 198.18.0.0/15 at the firewall or network layer; this does not fix the code-level gap but prevents exploitation of this specific bypass without rebuilding the application. Restricting which users can invoke the web_fetch integration (reducing the authenticated user pool) also limits exposure.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today