During our security research on WPGraphQL, we identified an SSRF protection bypass in the createMediaItem GraphQL mutation. The issue involved specially formatted IPv6 addresses that could bypass existing server-side URL validation and potentially expose internal services.
The vulnerability was responsibly disclosed, confirmed by the maintainers, and fixed in WPGraphQL 2.24.1. The finding was published as a High-severity GitHub Security Advisory, acknowledging our contribution.
The createMediaItem mutation allows users to retrieve media from remote URLs through the filePath parameter. Although WPGraphQL implemented validation to block requests to non-public IP addresses, the checks did not consistently handle different IPv6 representations.
During testing, we identified IPv4-compatible, IPv4-mapped, NAT64, and 6to4 addresses that could represent internal destinations while passing existing validation under certain conditions. Differences in PHP versions also affected how some addresses were classified.
This could allow an authenticated user with the upload_files capability to make server-side requests to internal destinations. Depending on the environment, this could expose internal service responses, sensitive information, or cloud metadata where additional protections did not prevent access.
We reported the issue to the WPGraphQL maintainers and collaborated with them to validate the affected address formats and understand differences across PHP versions. The investigation also highlighted DNS rebinding risks, where a hostname's resolution may change between validation and the actual request.
The issue was fixed in WPGraphQL 2.24.1. The remediation improved IPv6 validation by examining the underlying address bytes and explicitly checking non-public ranges, alongside addressing gaps in IPv4 filtering.The investigation also highlighted a broader security principle: validating user-supplied URLs is difficult, and accepting file contents directly through multipart uploads can eliminate the need for server-side URL fetching in suitable workflows.
- Project: WPGraphQL
- Vulnerability: SSRF protection bypass through IPv6 address representations
- Severity: High
- Affected versions: WPGraphQL 2.24.0 and earlier
- Fixed version: WPGraphQL 2.24.1
Published advisory: https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-3j5r-mp5g-4wrw
- Validate IP addresses using reliable parsing rather than text-based assumptions.
- Restrict server-side URL fetching and enforce network-level egress controls.
- Test security behavior across supported runtime versions.
- Account for DNS rebinding and differences between validation and connection.
- Prefer safer architectures that avoid unnecessary outbound requests.
Our research demonstrated how overlooked edge cases in address validation can undermine existing security controls. Effective security requires understanding how IP parsing, runtime behavior, and network access interact-not simply checking whether an address looks public.
We appreciate the WPGraphQL maintainers for their collaboration, thorough investigation, and responsible handling of the disclosure.
We will continue researching vulnerabilities and contributing to a more secure open-source ecosystem.Always assess systems only with authorization.
Users running affected versions should upgrade to WPGraphQL 2.24.1 or a later fixed release.
.png)
