Summary

Affected component and versions

• Package: lightrag-hku (LightRAG), the native markdown image-download path.
• Component: lightrag/parser/markdown/parser.py, guard validated addresses() (the if not (ip.is global or ...) check), reached from download() -> build guarded opener().open(req).
• Enabled by default: download enabled = env bool("NATIVE MD IMAGE DOWNLOAD ENABLED", True).
• Affected: LightRAG <= 1.5.4 (latest release at time of report, commit 9a45b64).
• Precondition: the caller can upload a document (API key via Depends(combined auth)); the host has NAT64/DNS64 routing for the encoded address to reach the internal endpoint.

Vulnerable code vs the guarded sibling

Note — CPython version dependency of the table. The is global verdicts above depend on the interpreter. CPython gh-113171 (backported to 3.10.14 / 3.11.9 / 3.12.3+, ~2024-04) added 64:ff9b:1::/48 and 2002::/16 to ipaddress. private networks, so on any current patch release those two rows return is global = False and are already blocked by the stdlib before the guard is reached. The 64:ff9b::/96 well-known NAT64 prefix and the IPv4-compatible ::/96 form bypass on every current CPython — and 64:ff9b::/96 is exactly the prefix real DNS64/NAT64 deployments use, so the vulnerability stands. The four-row table reflects a pre-gh-113171 interpreter. The fix classifies by the embedded IPv4 and therefore closes all forms regardless of interpreter version.

Severity

Proof of concept (deployed, both directions, verbatim)

attack URL = http://[64:ff9b::0a42:0002]:80/logo.png
===== DIRECTION A: ATTACK (NAT64-wrapped internal address) =====
guard verdict : PASSED (fetched)
SECRET LEAKED : True
body     : SSRF-LIGHTRAG-INTERNAL-METADATA-9f3a2b7c
===== control: plain internal address (must be BLOCKED) =====
verdict: BLOCKED at guard: non-public host blocked
===== DIRECTION B: PUBLIC address (must still be FETCHED) =====
guard verdict : PASSED (fetched)
public body  : PUBLIC-OK-BODY
===== SUMMARY =====
attack leaked internal secret = True
plain internal blocked    = True
public still fetched     = True

===== DIRECTION A: ATTACK (NAT64-wrapped internal address) =====
guard verdict : BLOCKED at guard: non-public host blocked
SECRET LEAKED : False
===== control: plain internal address (must be BLOCKED) =====
verdict: BLOCKED at guard: non-public host blocked
===== DIRECTION B: PUBLIC address (must still be FETCHED) =====
guard verdict : PASSED (fetched)
public body  : PUBLIC-OK-BODY
===== SUMMARY =====
attack leaked internal secret = False
plain internal blocked    = True
public still fetched     = True

Impact

Suggested fix

def unwrap embedded ipv4(ip):
  """Return the IPv4 embedded in an IPv6 transition wrapper (IPv4-mapped,
  IPv4-compatible, NAT64 64:ff9b::/96 and RFC8215 64:ff9b:1::/48, 6to4
  2002::/16) so it is classified by IPv4 rules; else return ip unchanged."""
  if ip.version != 6:
    return ip
  if ip.ipv4 mapped is not None:
    return ip.ipv4 mapped
  if getattr(ip, "sixtofour", None) is not None:
    return ip.sixtofour
  b = ip.packed
  if b[:12] == b"x00" * 12 and b[12:] not in (b"x00x00x00x00", b"x00x00x00x01"):
    return ip address(b[12:])
  if b[:12] == b"x00x64xffx9b" + b"x00" * 8:
    return ip address(b[12:])
  if b[:6] == b"x00x64xffx9bx00x01":
    return ip address(b[12:])
  return ip

judged = unwrap embedded ipv4(ip)
if not (judged.is global or any(ip in net for net in allow)):
  return []

Resolution

• Fixed-position transition wrappers are decoded and the embedded IPv4 must also be global (IPv4-mapped ::ffff:0:0/96, IPv4-compatible ::/96, and the NAT64 well-known prefix 64:ff9b::/96 — RFC 6052 §2.2, contiguous low-32 embedding). So 64:ff9b::7f00:1 (→ loopback) is blocked while 64:ff9b::808:808 (→ public 8.8.8.8) still passes.
• Blocks whose embedded-IPv4 position must not be trusted are default-denied as whole blocks, independent of the interpreter: the RFC 8215 local-use prefix 64:ff9b:1::/48 (technology-agnostic, embedded-IPv4 position not guaranteed per RFC 8215 §5 — a fixed-offset decode is itself bypassable, e.g. 64:ff9b:1:7f00:0:100:808:808 encodes 127.0.0.1 but its low 32 bits read as public 8.8.8.8) and 6to4 2002::/16 (IANA global-reachability N/A; current CPython classifies the whole block non-global — RFC 7526 deprecated only the 6to4 anycast relay path, not the 2002::/16 prefix itself). Decoding 6to4 by its embedded IPv4 would have re-permitted 2002::/16 addresses the stdlib already blocks, so it is denied outright instead.

Credit