Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from an incorrect implementation of the isLinkLocal() method within the Address6 class. The original code explicitly compared the first 64 bits of an IPv6 address to a hardcoded binary string representing fe80::/64. This approach failed to recognize the broader fe80::/10 range as link-local unicast, as specified by RFC 4291. Consequently, any IPv6 address within fe80::/10 but outside fe80::/64 would be misclassified as not link-local. This misclassification could lead to Server-Side Request Forgery (SSRF) or trust-boundary bypasses if an application relied on isLinkLocal() to filter internal or sensitive network requests. The patch directly addresses this by replacing the flawed 64-bit comparison with a call to this.isHostInSubnet(LINK_LOCAL_SUBNET), where LINK_LOCAL_SUBNET is correctly defined as fe80::/10. This change ensures that all addresses within the RFC-defined link-local range are properly identified.
Address6.isLinkLocalsrc/ipv6.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ip-address | npm | <= 10.5.0 | 10.5.1 |