The Liberapay webapp sends HTTP requests to IP addresses provided by the user, without checking that those addresses are public. There currently isn't any known way to exploit this vulnerability. Unfortunately, fixing it isn't trivial, because none of the underlying HTTP libraries (requests, urllib3, http.client) support limiting requests to globally reachable IP addresses.
urllib3/urllib3#3781 is a relevant pull request.
The Liberapay webapp sends HTTP requests to IP addresses provided by the user, without checking that those addresses are public. There currently isn't any known way to exploit this vulnerability. Unfortunately, fixing it isn't trivial, because none of the underlying HTTP libraries (
requests,urllib3,http.client) support limiting requests to globally reachable IP addresses.urllib3/urllib3#3781 is a relevant pull request.