Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE–2023–42282 #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

debricked[bot]
Copy link

@debricked debricked bot commented Apr 20, 2024

CVE–2023–42282

Vulnerability details

Description

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

NVD

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

GitHub

NPM IP package incorrectly identifies some private IP addresses as public

The isPublic() function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
References

    NPM IP package incorrectly identifies some private IP addresses as public · CVE-2023-42282 · GitHub Advisory Database · GitHub
    CVE-2023-42282 NPM Vulnerability in NetApp Products | NetApp Product Security
    NVD - CVE-2023-42282
    Missing IP Address Control in isPublic() Function Leads to SSRF Bypass PoC
    Socks package depends on vulnerable package ip · Issue #93 · JoshGlazebrook/socks · GitHub
    [GHSA-78xj-cgh5-2h22] NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks by G-Rath · Pull Request #3504 · github/advisory-database · GitHub
    lib: fixed CVE-2023-42282 and added unit test · indutny/node-ip@6a3ada9 · GitHub
    CVE-2023-42282 by Cofgren · Pull Request #138 · indutny/node-ip · GitHub
    lib: fixed CVE-2023-42282 and added unit test · indutny/node-ip@32f468f · GitHub
    huntr - The world’s first bug bounty platform for AI/ML

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

@debricked debricked bot force-pushed the debricked-fix-CVE_2023_42282-542c23092d5316af branch from 22a5409 to abd8a3b Compare April 25, 2024 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants