SSRF Vulnerability in ArcadeDB via IPv6 Transition Addressing

ArcadeDB versions prior to 26.9.1 contain an SSRF vulnerability within the security guards protecting the 'IMPORT DATABASE' and internal server commands. The vulnerability stems from the application's failure to properly validate IPv6 transition mechanisms, such as NAT64, 6to4, and Teredo, when parsing user-supplied URLs.

An authenticated attacker can abuse this deficiency by embedding RFC 1918 private IPv4 addresses or loopback addresses within these transition-style IPv6 addresses. When processed by the server, these payloads bypass the existing SSRF protection, forcing the ArcadeDB service to initiate outbound requests to unauthorized internal network destinations or cloud provider metadata services (e.g., 169.254.169.254). This can lead to information disclosure or the exploitation of other internal services that trust requests originating from the database host.

Impact

Successful exploitation allows an authenticated attacker to bypass network segmentation and interact with internal-only services or cloud-native metadata APIs. This could result in the exfiltration of sensitive configuration data, cloud environment credentials, or the execution of unauthorized actions against internal infrastructure, depending on the services accessible to the ArcadeDB instance.

Recommendation

• Upgrade ArcadeDB to version 26.9.1 or later to implement the corrected IPv6 address validation logic.
• Implement egress filtering at the network level to restrict database server access to only necessary external endpoints.
• Monitor database command logs for anomalous 'IMPORT DATABASE' or server management requests originating from non-administrative users.
• Restrict access to internal metadata endpoints (e.g., 169.254.169.254) from the network segment where the database resides.