CVE-2026-33693 activitypub-federation-rust SSRF 漏洞，可访问内网

Lemmy 中的 CVE-2026-33693 与 activitypub-federation-rust 库相关，允许远程攻击者绕过为了修复 CVE-2025-25194 而实施的 SSRF（服务器端请求伪造）保护。v4isinvalid() 函数未能正确验证 IPv4 地址 0.0.0.0 (UNSPECIFIED)。攻击者可以操纵远程域名使其指向此地址，从而允许他们访问目标服务器上的本地服务，即使之前的 SSRF 保护措施已到位。这构成重大风险，因为它允许对通常未暴露于外部网络的内部服务进行未经授权的访问。

Organizations using activitypub-federation-rust in their applications, particularly those hosting instances that federate with other ActivityPub servers, are at risk. Systems with exposed localhost services and those relying on the previous fix for CVE-2025-25194 are especially vulnerable.

• rust: Examine the src/utils.rs file for the v4isinvalid() function and verify that it correctly handles Ipv4Addr::UNSPECIFIED. • linux / server: Monitor system logs (journalctl) for unusual outbound connections to localhost originating from the activitypub-federation-rust process.

journalctl -u <activitypub-service-name> | grep '0.0.0.0'

• generic web: Use curl to test for SSRF by attempting to access internal services via the vulnerable endpoint.

curl -H "Host: internal-service" http://<vulnerable-host>/<vulnerable-endpoint>

1. 2026-03-25Disclosure

   disclosure

1. 已保留2026-03-23
2. 发布日期2026-03-25
3. 修改日期2026-04-02
4. EPSS 更新日期2026-04-03

此漏洞的解决方案是将 Lemmy 更新到 0.7.0-beta.9 或更高版本。此版本修复了 v4isinvalid() 函数，以包含 IPv4 地址 0.0.0.0 的验证。建议尽快应用此更新以降低被利用的风险。此外，请审查网络配置和防火墙规则，以确保仅允许来自受信任来源的必要服务访问。监控服务器日志以查找可疑活动也是推荐的做法。