EUVD-2026-37123
GHSA-q4x5-8cj6-52wg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (https://github.com/Sync-in/server) · only source for this CVE.
CVSS VectorVendor: https://github.com/Sync-in/server
Lifecycle Timeline
3DescriptionCVE.org
Summary: The private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems.
Affected components
backend/src/applications/files/services/files-manager.service.ts - downloadFromUrl() checks regExpPrivateIP against request.socket.remoteAddress. backend/src/applications/files/utils/url-file.ts - regExpPrivateIP does not include ::ffff:<ipv4> variants.
Details: The regExpPrivateIP regex in backend/src/applications/files/utils/url-file.ts correctly blocks standard IPv4 private ranges but does not include ::ffff: prefixed variants. On dual-stack systems, Node.js can report a socket's remoteAddress in IPv4-mapped IPv6 form, meaning the check in FilesManager.downloadFromUrl() can be bypassed entirely.
PoC: poc.pdf
Proof: <img width="1080" height="842" alt="1000226655" src="https://github.com/user-attachments/assets/797cea83-0a08-4a16-a91b-31c51068d473" />
Impact: An attacker can supply a crafted URL pointing to an internal address that gets reported as ::ffff:127.0.0.1 or ::ffff:10.x.x.x, causing the server to fetch internal resources that should be blocked. Any user with access to the file download feature is a potential attacker.
AnalysisAI
Server-Side Request Forgery in Sync-in Server versions 2.2.1 and earlier allows authenticated low-privileged users to bypass the private-IP blocklist by supplying URLs that resolve to IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:10.x.x.x). The URL download feature's regExpPrivateIP regex fails to recognize the dual-stack representation, letting the server fetch internal resources it should refuse. No public exploit identified at time of analysis beyond the reporter's PoC; the issue is not listed in CISA KEV.
Technical ContextAI
Sync-in is a Node.js/NestJS-based collaborative file server distributed as the npm package @sync-in/server. The flaw is a CWE-918 (SSRF) defect in backend/src/applications/files/utils/url-file.ts, where the regExpPrivateIP allowlist enumerates IPv4 private ranges (loopback, RFC1918, link-local) but omits the IPv6 dual-stack mapping prefix ::ffff:. When Node.js runs on a dual-stack socket, request.socket.remoteAddress for an IPv4 peer is reported as ::ffff:<ipv4>, and FilesManager.downloadFromUrl() in files-manager.service.ts evaluates the regex against that string, so addresses like 127.0.0.1 and 10.0.0.0/8 slip through. This is the same canonical pitfall behind many Node.js SSRF protections that string-match remote addresses rather than parsing them with net.isIP / IP address libraries that canonicalize mapped forms.
RemediationAI
Vendor-released patch: upgrade @sync-in/server to 2.3.0 or later (https://github.com/Sync-in/server/releases/tag/v2.3.0), which extends regExpPrivateIP to cover IPv4-mapped IPv6 forms; this is the primary fix and should be applied before any workaround. If patching must be deferred, disable or restrict the URL download feature in files-manager.service.ts to trusted admin accounts only (trade-off: users lose the import-from-URL workflow), or front Sync-in with an egress proxy/firewall rule that blocks outbound connections from the application host to RFC1918, loopback, link-local, and cloud metadata ranges (169.254.169.254) - note that egress filtering on the host kernel must be applied to both the IPv4 ranges and their ::ffff: equivalents to be effective. As an additional hardening step, force the Node.js HTTP agent to IPv4-only DNS resolution (family: 4) for the download client, which removes the dual-stack ambiguity at the cost of breaking IPv6-only target hosts.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today