The ssrfcheck library is affected by a Server-Side Request Forgery vulnerability that allows unauthenticated attackers to send requests to restricted multicast IP addresses.

This vulnerability is a Server-Side Request Forgery (CWE-918) caused by an inadequate filter for reserved IP address spaces. An unauthenticated attacker can leverage this flaw to force the application to interact with multicast addresses, potentially bypassing internal network security controls.

The vulnerability carries a CVSS score of 8.2, which reflects the high potential for unauthorized interaction with internal infrastructure. Successful exploitation could lead to unauthorized network reconnaissance or the ability to trigger actions within internal services that are otherwise protected from the public internet. This poses a significant risk to the integrity of internal network segmentation and may lead to further exploitation of downstream services.

Immediate Action: Update the ssrfcheck package to version 1.2.0 or later to implement the corrected IP address validation logic.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the application server, particularly those targeting internal IP ranges or multicast addresses.

Compensating Controls: Implement egress filtering at the network level to restrict the application server from communicating with internal network segments or unauthorized multicast ranges.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the linked GitHub Gist and issue tracker.

Given the High severity score and the availability of a public proof-of-concept, this vulnerability should be prioritized for remediation. Organizations using the ssrfcheck library must update to version 1.2.0 immediately to prevent potential network-layer abuse. Failure to patch leaves internal services exposed to unauthorized probes from the application layer.