CVE-2023-42282 — Server-Side Request Forgery in Node-ip

CWE-918 — Server-Side Request ForgeryCWE-941 — Incorrectly Specified Destination in a Communication Channel15 documents8 sources
Severity
9.8CRITICALNVD
NVD8.1
EPSS
0.7%
top 27.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
16
Fedorindutny IPDebian Node-ipMsrc Azl3 Nodejs 20.10.0-2 ON Azure Linux 3.0+13 more
Timeline
PublishedFeb 8
Latest updateAug 13

Description

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages18 packages

▶debiandebian/node-ip< node-ip 2.0.1+~1.1.3-3 (forky)+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
GHSA
ip SSRF improper categorization in isPublic↗2024-06-02
▶
OSV
ip SSRF improper categorization in isPublic↗2024-06-02
▶
OSV
CVE-2024-29415: The ip package through 2↗2024-05-27
▶
OSV
NPM IP package incorrectly identifies some private IP addresses as public↗2024-02-08
▶
OSV
CVE-2023-42282: The ip package before 1↗2024-02-08
▶

📋Vendor Advisories

6
Red Hat
node-ip: Incomplete fix for CVE-2023-42282↗2024-02-20
▶
Ubuntu
NPM IP vulnerability↗2024-02-19
▶
Microsoft
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.↗2024-02-13
▶
Red Hat
nodejs-ip: arbitrary code execution via the isPublic() function↗2024-02-08
▶
Debian
CVE-2024-29415: node-ip - The ip package through 2.0.1 for Node.js might allow SSRF because some IP addres...↗2024
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Critical SAP flaw allows remote attackers to bypass authentication↗2024-08-13
▶
CVE-2023-42282 — Server-Side Request Forgery in Node-ip | cvebase