CVE-2026-47684: Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

Synopsis

A server-side request forgery (SSRF) protection bypass affects Sync-in Server versions before 2.3.0. The URL download feature uses a regular expression to block requests to private IP ranges, but the regex fails to match IPv4-mapped IPv6 addresses (for example, ::ffff:127.0.0.1), so an attacker with a low-privilege account can craft a URL using this address format to make the server issue requests to internal network resources on dual-stack systems. Successful exploitation exposes internal service responses to the attacker, enabling unauthorized reads of data that should not be reachable from the outside. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Sync-in Server URL download endpoint over the network; the service must be internet- or intranet-accessible for exploitation to succeed.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must hold valid credentials for any standard user role on the Sync-in Server instance.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker submits a crafted URL directly to the download endpoint without involving another user.

• Attack complexityDetail

  Exploit complexity is low: no race conditions or special environmental factors are required, and the bypass works reliably on any dual-stack system running the affected regex logic.

Blast Radius

• Reads responses from internal HTTP services that should be blocked by SSRF protections, such as metadata endpoints, internal APIs, or admin panels reachable only from the host.
• Extracts sensitive data returned by those internal services, including credentials, tokens, or configuration details exposed on loopback or RFC-1918 addresses.
• Scope extends beyond the Sync-in Server process itself to other services on the same host or internal network segment, as indicated by the changed-scope (S:C) rating in the CVSS vector.