CVE-2024-29415 ip SSRF improper categorization in isPublic
The ip library for Node.js incorrectly categorizes certain IP addresses as public, allowing Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29415?
CVE-2024-29415 is a high-severity server-side request forgery vulnerability in n/a, published on 27 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Which versions are affected by CVE-2024-29415?
2 open source packages ship an affected version, including ip.
| Package | Affected | Fixed in |
|---|---|---|
ip npm | All versions to 2.0.1 | None |
ip npm | All versions to 2.0.1 | None |
How do I fix CVE-2024-29415?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-29415 being exploited?
There is no known exploitation of CVE-2024-29415 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1774657401, CLSA-2026-1792160906, DEBIAN-CVE-2024-29415, GHSA-2p57-rm9w-gvfp, MINI-8wm4-557r-8xf5, MINI-9gq3-34wx-wr7g and 3 more.