CVE-2023-42282
📋 TL;DR
The ip package for Node.js before version 1.1.9 incorrectly categorizes certain IP address formats (like 0x7f.1) as globally routable via the isPublic() function. This allows Server-Side Request Forgery (SSRF) attacks where attackers can bypass IP validation and make requests to internal network resources. Any Node.js application using the vulnerable ip package for IP validation is affected.
💻 Affected Systems
- Node.js applications using the 'ip' npm package
📦 What is this software?
Ip by Fedorindutny
Ip by Fedorindutny
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal services, cloud metadata endpoints, or administrative interfaces, potentially leading to data exfiltration, privilege escalation, or internal network compromise.
Likely Case
SSRF attacks bypassing IP validation controls to access internal HTTP services, APIs, or metadata endpoints that should be restricted.
If Mitigated
Limited impact if additional network segmentation, egress filtering, or request validation layers exist beyond the ip package.
🎯 Exploit Status
Proof of concept available in public references. Exploitation requires an application endpoint that uses isPublic() for validation and makes HTTP requests based on that validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ip package version 1.1.9
Vendor Advisory: https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
Restart Required: Yes
Instructions:
1. Update package.json to specify 'ip': '^1.1.9'. 2. Run 'npm update ip' or 'yarn upgrade ip'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Manual IP validation
allImplement custom IP validation logic that doesn't rely solely on the ip package's isPublic() function
Network egress filtering
allConfigure firewalls to restrict outbound connections from application servers to only necessary external destinations
🧯 If You Can't Patch
- Implement request validation at the application level to reject malformed IP addresses before passing to ip package
- Deploy network controls to restrict application server access to internal resources and metadata endpoints
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/ip/package.json for version < 1.1.9Check Version:
npm list ip | grep ip@ or node -e "console.log(require('ip/package.json').version)"Verify Fix Applied:
Verify ip package version is 1.1.9 or higher in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from application servers
- Requests to internal IP addresses or metadata endpoints
Network Indicators:
- HTTP requests with unusual IP formats in destination fields
- Traffic from application servers to restricted internal networks
SIEM Query:
source='application_logs' AND (dest_ip LIKE '%.%' OR dest_ip LIKE '0x%') AND action='outbound_request'🔗 References
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
- https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
- https://security.netapp.com/advisory/ntap-20240315-0008/
- https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
- https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
- https://security.netapp.com/advisory/ntap-20240315-0008/
- https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/
