TI-2023-18892 Aliases CVE-2023-37262

CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default

HIGH 76CWE-918Published 2023-07-07 · Updated 2024-11-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00899 59th percentileScored 2026-11-07

Fix Fixed CC-Tweaked (cc-tweaked): 1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cc-tweaked	CC-Tweaked	before 1.16.5-1.101.3; 1.17.0 to before 1.18.2-1.101.3; 1.19.0 to before 1.19.2-1.101.3; 1.19.3 to before 1.19.4-1.106.0; 1.20.0 to before 1.20.1-1.106.0	1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, 1.20.1-1.106.0	Patch available	CNA

CC-Tweaked Vendorcc-tweaked Affected before 1.16.5-1.101.3; 1.17.0 to before 1.18.2-1.101.3; 1.19.0 to before 1.19.2-1.101.3; 1.19.3 to before 1.19.4-1.106.0; 1.20.0 to before 1.20.1-1.106.0 Fixed in 1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, 1.20.1-1.106.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tweaked:cc-tweaked::::::minecraft::*	before 1.16.5-1.101.3; 1.17.1-1.98.1 to before 1.18.2-1.101.3; 1.19.1-1.100.9 to before 1.19.2-1.101.3; 1.19.3-1.102.0 to before 1.19.4-1.106.0; 1.20.1-1.105.0 to before 1.20.1-1.106.0	Vulnerable	Tweaked

cpe:2.3:a:tweaked:cc-tweaked:*:*:*:*:*:minecraft:*:* Versions before 1.16.5-1.101.3; 1.17.1-1.98.1 to before 1.18.2-1.101.3; 1.19.1-1.100.9 to before 1.19.2-1.101.3; 1.19.3-1.102.0 to before 1.19.4-1.106.0; 1.20.1-1.105.0 to before 1.20.1-1.106.0 Vulnerable ·Tweaked

Remediation

Fix · CNA CC-Tweaked (cc-tweaked) Fixed in 1.16.5-1.101.3, 1.18.2-1.101.3, 1.19.2-1.101.3, 1.19.4-1.106.0, 1.20.1-1.106.0

Timeline

2026-10-02 Threatist record created from CVE-2023-37262

References

Patch 1

https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf

Advisory 1

https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-7p4w-mv69-2wm2

Other 3

TI-2026-40247 CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection CVSS 4.0MEDIUM 6.9
TI-2026-35199 CC-Tweaked has an SSRF Protection Bypass with NAT64 CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences