Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in Koel's podcast functionality. The root cause is an inadequate IP address validation logic within the App\Helpers\Network::isPublicHost function. This function uses PHP's built-in filter_var with flags that do not account for certain IPv6-to-IPv4 transition mechanisms, specifically NAT64 and 6to4. An attacker can create a podcast feed with an enclosure URL whose hostname resolves to a specially crafted IPv6 address. When Koel's backend processes this URL, the isPublicHost function incorrectly identifies the malicious IPv6 address as public. The vulnerability is triggered in App\Values\Podcast\EpisodePlayable::createForEpisode, which relies on the flawed validation before proceeding to download the content from the provided URL. This allows an attacker to make the server issue requests to any IP address on the internal network, including cloud metadata services, and retrieve the full response. The patch addresses this by removing the custom validation logic and introducing a dependency on the mlocati/ip-lib library, which provides a much more robust and comprehensive way to classify IP addresses, correctly identifying and blocking the malicious transitional IPv6 addresses. The code was also refactored to introduce a SafeHttp service to centralize and enforce secure outbound requests, preventing this and other types of SSRF attacks.
Network::isPublicHostapp/Helpers/Network.php
EpisodePlayable::createForEpisodeapp/Values/Podcast/EpisodePlayable.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phanan/koel | composer | <= 9.7.0 | 9.7.1 |