GHSA-2p57-rm9w-gvfp

ghsaUSosv

ip SSRF improper categorization in isPublic

view advisory published 2024-06-02Licence: CC-BY-4.0

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-29415US	—	8.28% (95th)	Exploit	2024-05-27
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly cat…

references

External citations — patches, advisories, analysis.

https://github.com/indutny/node-ipPACKAGE
https://github.com/indutny/node-ip/issues/150WEB
https://github.com/indutny/node-ip/pull/143WEB
https://github.com/indutny/node-ip/pull/144WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-29415ADVISORY
https://security.netapp.com/advisory/ntap-20250117-0010WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan