SSRF Vulnerability in Node.js Package 'node-ip' - Improper IP Address Categorization
Summary
DEBIAN-CVE-2024-29415: The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPubl... Affects node-ip versions < 2.0.1+~1.1.3-3. Fixed in 2.0.1+~1.1.3-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'node-ip' package is a widely used library in Node.js applications that provides utilities for working with IP addresses. It allows developers to easily validate, manipulate, and categorize IP addresses. However, the package has been found to have a vulnerability that affects its ability to correctly identify certain IP addresses, potentially leading to security issues such as Server-Side Request Forgery (SSRF).
Vulnerability Detail
The vulnerability exists in the 'node-ip' package versions up to 2.0.1, where certain IP addresses, including localhost and improperly formatted addresses, are incorrectly classified as globally routable. This misclassification can allow an attacker to exploit the application by sending requests to internal services, leading to SSRF attacks. The issue arises from an incomplete fix for a previous vulnerability (CVE-2023-42282), which failed to address all edge cases in IP address validation.
How To Fix
Minimum fixed version
2.0.1+~1.1.3-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-ipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks in your application to ensure that IP addresses are properly categorized before making any requests. For example, you can manually check if an IP address belongs to a private range or is a loopback address before allowing it to be used in requests.
Conclusion
The 'node-ip' package has a vulnerability that can lead to SSRF due to improper categorization of certain IP addresses. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing validation checks can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for node-ip →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to data exposure or unauthorized access.
If your application uses the 'node-ip' package version 2.0.1 or earlier, it is potentially affected by this vulnerability. You can check your package version in your package.json or package-lock.json file.
Yes, you can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json to function.
If you cannot update the package right away, implement additional validation checks for IP addresses in your application to mitigate the risk of SSRF attacks.
You can find detailed information about this vulnerability in the official Debian CVE database or by visiting the Vulert playground to check if your application is affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ip.
