safe-bash: denyPrivateNetworks misses NAT64 (64:ff9b::/96) and IPv4-translated IPv6 forms

[kamilio]

Found in safe-bash deep pentest (v3). Verified with executed PoCs against current src/ on Node 22.

Severity: Medium — threat (b), environment-dependent: SSRF to cloud metadata on IPv6-only/NAT64 egress hosts

Summary

denyPrivateNetworks misses NAT64 (64:ff9b::/96) and IPv4-translated (::ffff:0:0/96) encodings of private IPv4 addresses. On IPv6-only egress hosts with NAT64 (exists in cloud/Workers-class environments), http://[64:ff9b::a9fe:a9fe]/ is the cloud-metadata IPv4 endpoint 169.254.169.254. The mapped-IPv4 extraction fires only for ::ffff:a.b.c.d (hextets[5]===0xffff); the NAT64 and ::ffff:0:0/96 forms fall through to the fc00::/7/fe80::/10 checks and pass. Contract §4 disclaims a "complete non-global-address registry", but these forms encode exactly the addresses the policy claims to deny.

Location

• packages/safe-bash/src/commands/network/authorizer.ts:28-29 — mapped-IPv4 extraction only when hextets[0..4]===0 && hextets[5]===0xffff

PoC (executed)

authorizer http://[64:ff9b::a9fe:a9fe]/latest/meta-data/: allowed=true   (169.254.169.254 via NAT64)
authorizer http://[::ffff:0:a9fe:a9fe]/latest/meta-data/: allowed=true
authorizer http://[64:ff9b::7f00:1]/:                     allowed=true   (127.0.0.1 via NAT64)
authorizer http://[::ffff:a9fe:a9fe]/:                    allowed=false  (control: mapped form denied)
curl dispatch http://[64:ff9b::a9fe:a9fe]/…: exit=28 ms=4011 — connection attempt ran the full 4 s deadline, i.e. dispatched past the policy boundary (no NAT64 on the test machine so it could not complete)

Suggested fix

In privateHostname, also expand ::ffff:0:0/96 (hextets[0..4]===0 && hextets[5]===0, IPv4 in hextets[6..7]) and 64:ff9b::/96 (hextets[0]===0x64 && hextets[1]===0xff9b && hextets[2..3]===0) and re-apply privateIPv4; document the decision if deliberately excluded.

Status: NEW

[kamilio]

Resolved in a73ea7d; verified on origin/main.