critical9.8
CVE-2023-42282
NPM IP package incorrectly identifies some private IP addresses as public
Impact
The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ip | = 2.0.0 | 2.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fedorindutny | Ip | before 1.1.9 Version 2.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
- https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
- https://security.netapp.com/advisory/ntap-20240315-0008/
- https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/
- https://github.com/advisories/GHSA-78xj-cgh5-2h22
- https://nvd.nist.gov/vuln/detail/CVE-2023-42282
- https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447
- https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999
- https://github.com/indutny/node-ip/pull/138
- https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa