critical9.8
CVE-2020-28360
Server-Side Request Forgery in private-ip
Impact
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | private-ip | < 2.0.0 | 2.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Private-Ip Project | Private-Ip | through 1.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/frenchbread/private-ip
- https://www.npmjs.com/package/private-ip
- https://github.com/advisories/GHSA-43ch-2h55-2vj7
- https://nvd.nist.gov/vuln/detail/CVE-2020-28360
- https://github.com/frenchbread/private-ip/commit/840664c4b9ba7888c41cfee9666e9a593db133e9
- https://johnjhacking.com/blog/cve-2020-28360/