Campfire SSRF Vulnerability Advisory (CVE-2026-100355): Internal Network Guard Bypass

The primary recommendation is to upgrade to version 1.4.5, which includes a fix for the IP filtering logic.

1. Update Package

# Perform update in the Campfire installation directory
git pull
bundle install

2. Temporary Mitigation - **WAF Configuration**: Implement rules to block outgoing requests or incoming link submissions containing special-use IP ranges such as `100.64.0.0/10`. - **Egress Filtering**: Configure network-level firewall rules to prevent the application server from initiating connections to internal management subnets.

This is a Server-Side Request Forgery (SSRF) vulnerability in Campfire's OpenGraph preview (unfurl) feature. The application utilizes RestrictedHTTP::PrivateNetworkGuard to block requests to private networks. However, it relies on Ruby's IPAddr predicates which fail to account for several special-use IP ranges. Specifically, ranges like CGNAT (100.64.0.0/10), NAT64 (64:ff9b::/96), and 6to4 (2002::/16) are not caught by standard private/loopback checks. An authenticated attacker can post a link resolving to these ranges to bypass the guard and force the server to interact with internal network resources. While the impact is primarily limited to leaked OpenGraph metadata, it poses a reconnaissance risk for internal infrastructure.