CVE-2024-28607 Server-side request forgery in IP-Utils
An attacker can bypass IP validation checks in the ip-utils library to perform Server-Side Request Forgery attacks against internal services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28607?
CVE-2024-28607 is a low-severity server-side request forgery vulnerability in librasean IP-Utils, published on 11 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.
Weakness: CWE-180
Which versions are affected by CVE-2024-28607?
How do I fix CVE-2024-28607?
No fix has been published for CVE-2024-28607 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-28607 being exploited?
There is no known exploitation of CVE-2024-28607 in the wild and no public exploit code.
Sources
Also known as GHSA-62ww-4cxc-jj93.