Cloudflare's handling of a bug in interpreting IPv4-mapped IPv6 addresses
Feb 2, 2023Lucas Ferreira, Aki Shugaeva, Yuchen Wu
Summary
This post details the discovery and remediation of a vulnerability where specific DNS records using IPv4-mapped IPv6 addresses could bypass network policies and connect to loopback or internal IP addresses. The vulnerability arose from two bugs: one in the internal DNS system's serialization of IPv4-mapped IPv6 addresses, and another in the internal HTTP proxy's validation logic which incorrectly compared addresses against the wrong deny list based on the IP family of the DNS API response. A hotpatch was deployed to block exploitation by preventing the creation of such DNS records, followed by a permanent fix in the proxy service to correctly validate IP addresses against the appropriate deny list.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack