fix(security): require is_global in the SSRF guard (GHSA-cx77-j6h8-3382) (#165)

validate_public_url classified resolved addresses with a category denylist, and 100.64.0.0/10 (RFC 6598 shared address space) satisfies none of those categories: it is is_global False but neither private nor reserved. A URL resolving into it passed the guard and was fetched server-side, and the redirect hook allowed hops that stayed inside the range. That range hosts internal services on GKE and other Kubernetes clusters, cloud internal endpoints and ISP CGNAT.

The guard now tests positively for is_global, keeps the category checks alongside it, and names the non-public networks explicitly because is_global's backing table has shifted across CPython patch releases. IPv4-mapped addresses are still unwrapped first.

Bumps to 1.0.125 and documents the advisory in SECURITY.md.

Author: nictuku

SECURITY.md

@@ -301,3 +301,40 @@ is what makes an unsolicited callback useless.
   have been open, reconnect the Meta account so a fresh token is issued.
 - Credited to [@Gal3m](https://github.com/Gal3m) and
   [@mohammad228](https://github.com/mohammad228).
+
+### GHSA-cx77-j6h8-3382 — SSRF guard allowed shared address space (`100.64.0.0/10`)
+
+- **Severity:** Medium
+- **Affected versions:** `>= 1.0.115, <= 1.0.124` — i.e. every version carrying
+  the original SSRF guard.
+- **Fixed in:** `1.0.125`
+- **Affected configurations:** Deployments where non-public services live in
+  `100.64.0.0/10` — GKE and other Kubernetes clusters default pod/service CIDRs
+  into that range, as do cloud internal endpoints and ISP CGNAT — and where a
+  caller can drive `upload_ad_image` or the image-viewing tools (including an
+  agent acting on injected instructions).
+
+**What went wrong.** `validate_public_url` classified a resolved address with a
+category denylist: `is_private or is_loopback or is_link_local or is_reserved or
+is_multicast or is_unspecified`. `100.64.0.0/10` (RFC 6598 shared address space)
+satisfies none of those — it is `is_global == False` but neither private nor
+reserved — so a URL resolving into it passed the guard and was fetched
+server-side, and the redirect re-validation hook allowed redirects that stayed
+inside the range. Loopback, RFC 1918 and link-local (including the cloud
+metadata endpoint) remained blocked, so the exposure was a partial internal-range
+SSRF confined to shared address space.
+
+**Fix.** The guard now tests positively for `ip.is_global` and rejects anything
+else, so non-public ranges no longer have to be enumerated to be blocked. The
+original category checks are kept alongside it, plus an explicit list of
+non-public networks (`100.64.0.0/10`, `192.0.0.0/24`, `198.18.0.0/15`, the RFC
+5737 TEST-NETs, `240.0.0.0/4`, `2001:db8::/32`, `64:ff9b:1::/48`), because
+`is_global`'s backing table has shifted across CPython patch releases. IPv4-mapped
+IPv6 addresses are still unwrapped first, so `::ffff:100.64.1.1` is rejected too.
+
+**Action for operators.**
+- Upgrade to `1.0.125` or later.
+- If you ran an earlier version where `100.64.0.0/10` reaches internal services,
+  review outbound request logs for fetches into that range.
+- Credited to [@Gal3m](https://github.com/Gal3m) and
+  [@mohammad228](https://github.com/mohammad228).

meta_ads_mcp/__init__.py

@@ -6,7 +6,7 @@
 
 from meta_ads_mcp.core.server import main
 
-__version__ = "1.0.124"
+__version__ = "1.0.125"
 
 __all__ = [
     'get_ad_accounts',

meta_ads_mcp/core/utils.py

@@ -164,26 +164,54 @@ class BlockedURLError(Exception):
 
 _ALLOWED_URL_SCHEMES = ("http", "https")
 
+# Non-public ranges named explicitly, because `is_global`'s backing table has
+# changed across CPython patch releases and a category denylist alone missed
+# them (GHSA-cx77-j6h8-3382: 100.64.0.0/10 is neither private nor reserved, so
+# it passed the original check while hosting internal services on the
+# deployments that use it — GKE pod/service CIDRs, cloud internal endpoints,
+# ISP CGNAT).
+_BLOCKED_NETWORKS = tuple(
+    ipaddress.ip_network(cidr)
+    for cidr in (
+        "100.64.0.0/10",     # RFC 6598 shared address space (CGNAT)
+        "192.0.0.0/24",      # RFC 6890 IETF protocol assignments
+        "192.0.2.0/24",      # RFC 5737 TEST-NET-1
+        "198.18.0.0/15",     # RFC 2544 benchmarking
+        "198.51.100.0/24",   # RFC 5737 TEST-NET-2
+        "203.0.113.0/24",    # RFC 5737 TEST-NET-3
+        "240.0.0.0/4",       # RFC 1112 reserved, incl. 255.255.255.255
+        "2001:db8::/32",     # RFC 3849 documentation
+        "64:ff9b:1::/48",    # RFC 8215 local-use IPv4/IPv6 translation
+    )
+)
+
 
 def _ip_is_disallowed(ip) -> bool:
     """Return True if `ip` is not a public, routable address.
 
-    Blocks private, loopback, link-local (incl. 169.254.169.254 cloud
-    metadata), reserved, multicast, and unspecified addresses. IPv4-mapped
-    IPv6 addresses (e.g. ::ffff:127.0.0.1) are unwrapped first so they can't
-    be used to smuggle a private IPv4 target past the check.
+    The primary test is positive — an address must be `is_global` — so ranges
+    that are simply not public (shared address space, benchmarking, TEST-NETs)
+    are rejected without having to be enumerated. The category checks and the
+    explicit network list are kept alongside it as belt and braces.
+
+    IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) are unwrapped first so
+    they cannot smuggle a non-public IPv4 target past the check.
     """
     mapped = getattr(ip, "ipv4_mapped", None)
     if mapped is not None:
         ip = mapped
-    return (
+    if (
         ip.is_private
         or ip.is_loopback
         or ip.is_link_local
         or ip.is_reserved
         or ip.is_multicast
         or ip.is_unspecified
-    )
+    ):
+        return True
+    if not ip.is_global:
+        return True
+    return any(ip in network for network in _BLOCKED_NETWORKS)
 
 
 def validate_public_url(url: str) -> None:
@@ -230,8 +258,9 @@ def validate_public_url(url: str) -> None:
         if _ip_is_disallowed(ip):
             raise BlockedURLError(
                 f"Refusing to fetch '{host}': it resolves to a non-public address "
-                f"({ip}). Private, loopback, link-local, and cloud-metadata "
-                "addresses are blocked to prevent server-side request forgery."
+                f"({ip}). Private, loopback, link-local, shared (CGNAT), reserved "
+                "and cloud-metadata addresses are blocked to prevent server-side "
+                "request forgery."
             )
 
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "meta-ads-mcp"
-version = "1.0.124"
+version = "1.0.125"
 description = "Model Context Protocol (MCP) server for Meta Ads - Use Remote MCP at pipeboard.co for easiest setup"
 readme = "README.md"
 requires-python = ">=3.10"

server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "co.pipeboard/meta-ads-mcp",
   "description": "Facebook / Meta Ads automation with AI: analyze performance, test creatives, optimize spend.",
-  "version": "1.0.124",
+  "version": "1.0.125",
   "remotes": [
     {
       "type": "streamable-http",

tests/test_ssrf_url_validation.py

@@ -5,11 +5,17 @@
 caller-supplied URL server-side, so the URL must be restricted to public
 http(s) targets before any connection is opened.
 
+Also covers GHSA-cx77-j6h8-3382: the first fix classified addresses with a
+category denylist, which let 100.64.0.0/10 (RFC 6598 shared address space, used
+for GKE pod/service CIDRs and ISP CGNAT) through because it is neither private
+nor reserved. The guard now requires `is_global`.
+
 These tests use literal IPs for the block/allow matrix so they do not depend on
 network DNS; only the "localhost" case exercises real name resolution (which is
 universally available).
 """
 
+import ipaddress
 import json
 from unittest.mock import AsyncMock, patch
 
@@ -18,6 +24,7 @@
 
 from meta_ads_mcp.core.utils import (
     BlockedURLError,
+    _ip_is_disallowed,
     validate_public_url,
     download_image,
     try_multiple_download_methods,
@@ -41,6 +48,18 @@
     "http://[fe80::1]/",                   # IPv6 link-local
     "http://[fc00::1]/",                   # IPv6 unique-local (private)
     "https://169.254.169.254/",            # https also blocked
+    # GHSA-cx77-j6h8-3382 — non-public, but neither private nor reserved, so a
+    # category denylist let these through.
+    "http://100.64.1.1/internal",          # RFC 6598 shared address space
+    "http://100.127.255.254/",             # top of the shared range
+    "http://[::ffff:100.64.1.1]/",         # IPv4-mapped shared address
+    "http://192.0.0.1/",                   # IETF protocol assignments
+    "http://198.18.0.5/",                  # benchmarking range
+    "http://192.0.2.9/",                   # TEST-NET-1
+    "http://198.51.100.9/",                # TEST-NET-2
+    "http://203.0.113.9/",                 # TEST-NET-3
+    "http://240.0.0.1/",                   # reserved (class E)
+    "http://[2001:db8::1]/",               # IPv6 documentation range
 ]
 
 
@@ -93,6 +112,43 @@ def test_validate_public_url_allows_public_ip_literals(url):
     validate_public_url(url)
 
 
+# --- GHSA-cx77-j6h8-3382: shared address space -------------------------------
+
+@pytest.mark.parametrize(
+    "address",
+    ["100.64.0.0", "100.64.1.1", "100.127.255.254", "100.127.255.255"],
+)
+def test_shared_address_space_is_not_public(address):
+    """100.64.0.0/10 is is_global == False but is_private == False, which is
+    exactly the gap the category denylist had."""
+    ip = ipaddress.ip_address(address)
+
+    assert not ip.is_private, "test would pass for the wrong reason"
+    assert _ip_is_disallowed(ip)
+
+
+@pytest.mark.parametrize("address", ["100.63.255.255", "100.128.0.0", "8.8.8.8"])
+def test_addresses_outside_the_shared_range_stay_reachable(address):
+    """The bounds matter: 100.64.0.0/10 is not all of 100.0.0.0/8."""
+    assert not _ip_is_disallowed(ipaddress.ip_address(address))
+
+
+async def test_redirect_into_shared_address_space_is_blocked():
+    def handler(request: httpx.Request) -> httpx.Response:
+        if request.url.host == "8.8.8.8":
+            return httpx.Response(302, headers={"Location": "http://100.64.1.1/internal"})
+        return httpx.Response(200, content=b"SHOULD-NOT-BE-FETCHED")
+
+    transport = httpx.MockTransport(handler)
+    async with httpx.AsyncClient(
+        transport=transport,
+        follow_redirects=True,
+        event_hooks={"request": [_ssrf_guard_request_hook]},
+    ) as client:
+        with pytest.raises(BlockedURLError):
+            await client.get("https://8.8.8.8/start")
+
+
 # --- request event hook (covers redirect hops) ------------------------------
 
 async def test_ssrf_guard_request_hook_blocks_internal():