Keep link-local/cloud-metadata ranges blocked when Allow Private IPs is on #7

New issue

Closed

opened 2026-10-16 21:01:55 -07:00 by eric · 0 comments

eric commented

2026-10-16 21:01:55 -07:00

Owner

Hardening from security audit run 3 (2026-10-16, 06d630d).

Problem

One setting, "Allow Private IPs", lifts both FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE (includes/class-apprise-client.php:463-490). Enabling it to reach a LAN Apprise server therefore also opens link-local 169.254.0.0/16, which holds the cloud metadata services (169.254.169.254). AWS IMDS on IPv6 at fd00:ec2::254 opens with it too. No real Apprise server runs on these addresses, so allowing them only adds a high-value target.

Fix

Keep 169.254.0.0/16, fe80::/10 and fd00:ec2::254 blocked even when allow_private_ips is on.
Let them through only when the apprise_notifications_allow_private_ip filter returns true explicitly for that IP, so the opt-in stays code-level.
Update the setting's help text to say link-local and metadata addresses stay blocked.
Regression cases: with allow_private_ips = true, 10.0.0.5 is accepted, while 169.254.169.254 and [fd00:ec2::254] are rejected.

Related: #5 adds 100.100.100.200 (Alibaba Cloud metadata) to the blocked ranges.

Hardening from security audit run 3 (2026-10-16, `06d630d`). ## Problem One setting, "Allow Private IPs", lifts both `FILTER_FLAG_NO_PRIV_RANGE` and `FILTER_FLAG_NO_RES_RANGE` (`includes/class-apprise-client.php:463-490`). Enabling it to reach a LAN Apprise server therefore also opens link-local `169.254.0.0/16`, which holds the cloud metadata services (`169.254.169.254`). AWS IMDS on IPv6 at `fd00:ec2::254` opens with it too. No real Apprise server runs on these addresses, so allowing them only adds a high-value target. ## Fix - Keep `169.254.0.0/16`, `fe80::/10` and `fd00:ec2::254` blocked even when `allow_private_ips` is on. - Let them through only when the `apprise_notifications_allow_private_ip` filter returns true explicitly for that IP, so the opt-in stays code-level. - Update the setting's help text to say link-local and metadata addresses stay blocked. - Regression cases: with `allow_private_ips = true`, `10.0.0.5` is accepted, while `169.254.169.254` and `[fd00:ec2::254]` are rejected. Related: #5 adds `100.100.100.200` (Alibaba Cloud metadata) to the blocked ranges.

eric added the

enhancement

label

2026-10-16 21:01:55 -07:00

eric referenced this issue from a commit

2026-10-16 21:58:09 -07:00

fix: keep link-local and cloud metadata blocked with Allow Private IPs on

eric closed this issue

2026-10-16 21:58:09 -07:00