CVE-2023-42282 NPM IP package incorrectly identifies some private IP addresses as public
An attacker can bypass IP validation checks in the Node.js ip package to perform Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-42282?
CVE-2023-42282 is a critical server-side request forgery vulnerability in n/a, published on 8 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Weakness: CWE-918
Which versions are affected by CVE-2023-42282?
4 open source packages ship an affected version, including ip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ip npm | All versions | 1.1.9 |
ip npm | All versions | 1.1.9 |
ip npm | From 2.0.0 | 2.0.1 |
ip npm | From 2.0.0 | 2.0.1 |
Products include Fedorindutny Ip.
How do I fix CVE-2023-42282?
Upgrade ip to a fixed version for your release line: 1.1.9 or 2.0.1.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-42282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42282 exists.
Sources
Also known as AZL-34379, AZL-34380, AZL-34439, AZL-35042, CLSA-2026-1774657398, CLSA-2026-1774657399 and 6 more.