CVE-2021-33516: 
NixOS vulnerability analysis and mitigation

CVE-2021-33516 is a DNS rebinding vulnerability discovered in GUPnP (versions before 1.0.7 and 1.1.x and 1.2.x before 1.2.5). The vulnerability was disclosed on May 24, 2021. GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup (NVD, GNOME Discourse).

The vulnerability allows DNS rebinding attacks where a remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (NVD).

If exploited, this vulnerability could lead to data exfiltration, data tampering, and unwanted or harmful remote calls from malicious websites to local UPnP services. The impact is significant as it could allow attackers to bypass same-origin policies and interact with local services without authorization (GNOME Discourse).

The vulnerability requires user interaction as the victim must visit a malicious website for the attack to be successful. The attack vector is network-based (remote) and does not require privileges, making it relatively easy to exploit given the right conditions (NVD).

The vulnerability has been fixed in GUPnP versions 1.0.7 and 1.2.5 (later updated to 1.2.6 due to dependency issues). The fix involves validating host headers to prevent DNS rebinding attacks. As a workaround, users can utilize a DNS resolver that prevents DNS rebinding until patches can be applied (GNOME Discourse).