The SSRF protection bypass in misp-modules' html_to_markdown expansion module occurs because IP addresses are checked against restricted ranges without normalizing IPv4-mapped IPv6 addresses. Attackers with authentication can supply IPv4-mapped IPv6 addresses or hostnames resolving to such addresses, which are treated as IPv6 and thus bypass the blocked IPv4 range checks. This allows the server to connect to internal network services, potentially exposing sensitive internal web services, administrative interfaces, or cloud metadata endpoints. The fix involves normalizing IPv4-mapped IPv6 addresses to their IPv4 equivalents before applying IP range checks and rejecting URLs lacking valid hostnames.

An authenticated attacker can exploit this vulnerability to cause the misp-modules server to connect to internal or restricted network services, including loopback and cloud instance metadata endpoints. This may lead to exposure of sensitive internal resources or data, with the retrieved content possibly returned to the attacker as converted Markdown. The vulnerability has a high severity with a CVSS 4.0 score of 8.3, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is addressed by normalizing IPv4-mapped IPv6 addresses to their underlying IPv4 representation before applying blocked-range checks and rejecting URLs without valid hostnames. Until an official fix is confirmed, restrict access to the html_to_markdown module to trusted authenticated users and monitor for suspicious usage patterns.