CVE-2020-28360 Server-Side Request Forgery in private-ip
Insufficient regex filtering in the private-ip npm package allows attackers to bypass IP restrictions and perform Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28360?
CVE-2020-28360 is a critical server-side request forgery vulnerability in n/a, published on 23 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.
Weakness: CWE-918
Which versions are affected by CVE-2020-28360?
2 open source packages ship an affected version, including private-ip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
private-ip npm | All versions | 2.0.0 |
private-ip npm | All versions | 2.0.0 |
Products include Private-Ip Project Private-Ip.
How do I fix CVE-2020-28360?
Upgrade private-ip to 2.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-28360 being exploited?
There is no known exploitation of CVE-2020-28360 in the wild and no public exploit code.
Sources
Also known as GHSA-43ch-2h55-2vj7.