CVE-2026-33693: SSRF via 0.0.0.0 Bypass in activitypub-federation-rust v4_is_invalid() (CVSS 6.5 Moderate)

Keywords: SSRF, 0.0.0.0, IP validation bypass, activitypub-federation, Lemmy, Rust, ActivityPub

Table of Contents

• Overview
• Vulnerability Details
• Technical Analysis
• Attack Chain
• Impact
• Remediation
• CVSS v3.1 Metrics
• Timeline
• References
• Contact
• Disclaimer

Overview

A Server-Side Request Forgery (SSRF) vulnerability exists in the activitypub-federation-rust library (used by Lemmy and 6+ downstream projects) due to an incomplete IP address validation check in the v4_is_invalid() function. The function fails to call is_unspecified(), allowing an attacker to bypass SSRF protections by targeting 0.0.0.0 — which maps to localhost on most systems.

• Package: activitypub_federation (Rust/cargo)
• Affected Versions: <= 0.7.1
• Fixed In: PR #162

Vulnerability Details

The v4_is_invalid() function in src/utils.rs validates IPv4 addresses to block internal network access. It checks for loopback (127.0.0.0/8), private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and broadcast (255.255.255.255), but does not check for the unspecified address 0.0.0.0.

On most systems, 0.0.0.0 resolves to the loopback interface, granting the same access as 127.0.0.1.

Secondary Finding: A DNS Rebinding / TOCTOU vulnerability also exists where lookup_host() resolves a hostname and validates the IP, but a separate reqwest call performs a second DNS resolution — allowing an attacker to serve a safe IP first, then rebind to an internal IP on the second resolution.

Technical Analysis

Vulnerable Code (src/utils.rs)

fn v4_is_invalid(ip: &Ipv4Addr) -> bool {
    ip.is_loopback()
        || ip.is_private()
        || ip.is_link_local()
        || ip.is_broadcast()
        // MISSING: || ip.is_unspecified()  <- 0.0.0.0 not blocked
}

Fixed Code

fn v4_is_invalid(ip: &Ipv4Addr) -> bool {
    ip.is_loopback()
        || ip.is_private()
        || ip.is_link_local()
        || ip.is_broadcast()
        || ip.is_unspecified()  // <- Now blocks 0.0.0.0
}

Attack Chain

+---------------------------------------------------+
|           SSRF via 0.0.0.0 Bypass                 |
+---------------------------------------------------+
|                                                   |
|  1. Attacker hosts ActivityPub object with        |
|     URL pointing to http://0.0.0.0:<port>/path    |
|                                                   |
|  2. Lemmy instance fetches the object via         |
|     activitypub-federation-rust                   |
|                                                   |
|  3. v4_is_invalid() checks IP address:            |
|     x is_loopback()     -> false (not 127.x)     |
|     x is_private()      -> false (not RFC1918)    |
|     x is_link_local()   -> false (not 169.254.x) |
|     x is_broadcast()    -> false (not 255.x)     |
|     x is_unspecified()  -> NOT CHECKED            |
|     Result: 0.0.0.0 PASSES validation            |
|                                                   |
|  4. Request sent to 0.0.0.0 -> resolves to       |
|     localhost -> accesses internal services       |
|                                                   |
|  5. Internal service data returned to attacker    |
|     via ActivityPub federation response           |
|                                                   |
+---------------------------------------------------+

Impact

Downstream Exposure: The activitypub-federation-rust crate is used by 6+ projects in the Fediverse ecosystem:

An attacker can:

• Access internal services (databases, admin panels, cloud metadata endpoints)
• Scan internal ports on the Lemmy/federation server
• Exfiltrate cloud credentials via metadata APIs

Remediation

• Upgrade activitypub-federation to a version containing the fix from PR #162
• Lemmy users: Apply the backport from lemmy#6411

CVSS v3.1 Metrics

Timeline

References

• GHSA-q537-8fr5-cw35
• CVE-2026-33693
• Fix PR #162
• Lemmy Backport PR #6411
• CWE-918: Server-Side Request Forgery

Contact

• Website: snailsploit.com
• GitHub: @SnailSploit
• LinkedIn: /in/kaiaizen

Disclaimer

This repository is published for educational and defensive purposes as part of responsible vulnerability disclosure. The vulnerability was reported through GitHub's Private Vulnerability Reporting (PVRT) process. No exploitation was performed against production systems. All testing was conducted in isolated environments.

📚 Documentation & Author

This project's full writeup, methodology, and related research lives at:

https://snailsploit.com/security-research/cves/cve-2026-33693/

Created by Kai Aizen — independent offensive security researcher.

snailsploit.com · Research · Frameworks · GitHub · LinkedIn · ResearchGate · X/Twitter

Same attack. Different substrate.