GitHub Advisoryadvisory · npm

GHSA-2p57-rm9w-gvfp ip SSRF improper categorization in isPublic

HIGH Published 2024-06-02 Modified 2025-01-17 Official page ↗
Aliases
CVE-2024-29415
Ecosystem
npm
Packages
ip
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2024-06-02

Affected packages

• npm ip: <= 2.0.1 (no fix yet)

Description

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Related

Alias · CVE (1)

  • CVE-2024-29415 The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01,… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References