GitHub Advisoryadvisory · npm

GHSA-78xj-cgh5-2h22 NPM IP package incorrectly identifies some private IP addresses as public

LOW Published 2024-02-08 Modified 2024-06-28 Official page ↗
Aliases
CVE-2023-42282
Ecosystem
npm
Packages
ip
Severity
Low
Weaknesses
CWE-918
Reviewed
2024-02-09

Affected packages

• npm ip: >= 2.0.0, < 2.0.1 → fixed in 2.0.1 • npm ip: < 1.1.9 → fixed in 1.1.9

Description

The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

Related

Alias · CVE (1)

  • CVE-2023-42282 The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References