NPM IP package incorrectly identifies some private IP addresses as public
The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-42282US | critical9.8 | — | ||
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic. | ||||
02
references
External citations — patches, advisories, analysis.
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.htmlWEB
- https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447WEB
- https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999WEB
- https://github.com/indutny/node-ipPACKAGE
- https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aaWEB
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894WEB
- https://github.com/indutny/node-ip/pull/138WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-42282ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan