Critical SSRF Vulnerability in node-ip Package
Summary
USN-6643-1: node-ip vulnerability. Affects node-ip versions < 1.1.5-1ubuntu0.1~esm1. Fixed in 1.1.5-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ip package is a popular library used in Node.js applications for handling IP addresses. It provides functionalities to validate and manipulate IP addresses, distinguishing between public and private addresses. This package is widely utilized in various applications to ensure proper network communication and security. However, a recent vulnerability has been discovered that compromises its ability to accurately differentiate between private and public IP addresses, potentially exposing applications to security risks.
Vulnerability Detail
Emre Durmaz discovered that the node-ip package incorrectly distinguished between private and public IP addresses. This flaw allows a remote attacker to exploit the vulnerability and perform Server-Side Request Forgery (SSRF) attacks. SSRF attacks can enable attackers to send unauthorized requests from the server to internal resources, leading to data exposure or further exploitation of the server's network.
How To Fix
Minimum fixed version
1.1.5-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-ipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing network-level controls to restrict access to sensitive internal resources. Additionally, validate and sanitize all incoming requests to ensure they do not contain malicious payloads that could exploit this vulnerability.
Conclusion
The node-ip package has a critical vulnerability that could allow remote attackers to perform SSRF attacks. It is crucial for users of this package to update to the patched versions provided for their respective Ubuntu distributions. Implementing workarounds and using monitoring tools like Vulert can further enhance security.
See every vulnerability recorded for node-ip →
FAQ
The node-ip package is a Node.js library used for handling and validating IP addresses, providing functionalities to distinguish between public and private addresses.
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send unauthorized requests from a vulnerable server to internal resources.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to internal services, data exposure, and further exploitation of the server's network.
Using tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time, can help you stay informed about potential risks in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ip.
