From 32e4315c8374cbff234168bbd7d4510f6052bc19 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Wed, 21 Oct 2026 08:51:52 +0000
Subject: [PATCH] CVE-2026-102648 DSMLv2 gateway: incomplete internal-address check allows SSRF when anyURI dereferencing is enabled
---
opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java | 17 +++++++++++++++++
1 files changed, 17 insertions(+), 0 deletions(-)
diff --git a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
index b1e787e..15fefeb 100644
--- a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
+++ b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
@@ -128,6 +128,7 @@
private static final String DEREF_ANYURI = "ldap.dsml.dereference.anyuri";
private static final String DEREF_ANYURI_SCHEMES = "ldap.dsml.dereference.anyuri.schemes";
private static final String DEREF_ANYURI_MAXSIZE = "ldap.dsml.dereference.anyuri.maxsize";
+ private static final String DEREF_ANYURI_NAT64PREFIXES = "ldap.dsml.dereference.anyuri.nat64prefixes";
private static final String MAX_BATCH_REQUESTS = "ldap.dsml.batchrequests.max";
private static final String REQUEST_MAXSIZE = "ldap.dsml.request.maxsize";
private static final String MAX_OPERATIONS = "ldap.dsml.batchrequest.operations.max";
@@ -247,6 +248,22 @@
{
ByteStringUtility.setMaxUriContentLength(positiveValue(DEREF_ANYURI_MAXSIZE, maxSize));
}
+ // NAT64 Network-Specific Prefixes cannot be detected from an address
+ // (an NSP is ordinary operator address space), so deployments using
+ // NAT64 with an NSP must declare it for the embedded IPv4 address to
+ // be filtered like the built-in transition prefixes.
+ String nat64Prefixes = stringValue(config, DEREF_ANYURI_NAT64PREFIXES);
+ if (nat64Prefixes != null && !nat64Prefixes.trim().isEmpty())
+ {
+ try
+ {
+ ByteStringUtility.setNat64Prefixes(nat64Prefixes);
+ }
+ catch (IllegalArgumentException e)
+ {
+ throw new ServletException(DEREF_ANYURI_NAT64PREFIXES + ": " + e.getMessage());
+ }
+ }
}
// Every batchRequest element of a SOAP body is executed over its own
--
Gitblit v1.10.0