Description

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-16T14:16:55.370Z",
  "pubdate": "2026-08-16T14:16:55.370Z",
  "executiveSummary": "An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in stoatchat versions prior to 0.15.0.\nThe vulnerability stems from an incomplete IP blocklist implementation that fails to restrict the IPv6 unspecified address (::).\nUnauthenticated remote attackers can leverage the /proxy and /embed endpoints to bypass existing SSRF filtering mechanisms.\nBy crafting malicious HTTP requests utilizing IPv6 literal syntax, threat actors can successfully target and interact with services bound to the internal loopback interface.\nThe primary impact of successful exploitation includes unauthorized access to internal network infrastructure and the potential retrieval of sensitive internal content.\nThis flaw introduces significant risk to internal confidentiality and service availability by subverting application-level perimeter defenses designed to prevent unauthorized external requests to internal resources.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the stoatchat application, specifically affecting the /proxy and /embed endpoints which process user-supplied URLs.\nThe root cause is an inadequate Server-Side Request Forgery (SSRF) blocklist validation mechanism that fails to recognize and mitigate the IPv6 unspecified address (::) alongside standard IPv4 loopback notations.\nAffected software versions include all stoatchat deployments prior to version 0.15.0.\nThe vulnerability requires zero authentication and no prior privileges, making the affected endpoints fully exposed to unauthenticated remote attackers over the network.\nTo execute the attack, an unauthenticated threat actor crafts an HTTP request directed at either the /proxy or /embed endpoint, supplying a target URL containing IPv6 literal syntax that resolves to the loopback interface via the unspecified address (::).\nBecause the input validation logic lacks a comprehensive sanitization rule for the IPv6 unspecified address, the application parses the request and initiates an outbound network connection from the server hosting stoatchat to the internal loopback service.\nUpon successful connection establishment, the internal service processes the request and returns the response content to the proxy or embed endpoint.\nThe vulnerable application subsequently exposes this internal content back to the unauthenticated attacker.\nThis post-exploitation behavior enables attackers to probe internal microservices, access restricted administrative interfaces, and exfiltrate sensitive internal data that is normally inaccessible from the external network perimeter."
}