Homepage
About Snyk

ip@1.1.7 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the ip package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Server-Side Request Forgery (SSRF)

ip is a Node library.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the isPublic function, which identifies some private IP addresses as public addresses due to improper parsing of the input. An attacker can manipulate a system that uses isLoopback(), isPrivate() and isPublic functions to guard outgoing network requests to treat certain IP addresses as globally routable by supplying specially crafted IP addresses.

Note

This vulnerability derived from an incomplete fix for CVE-2023-42282

How to fix Server-Side Request Forgery (SSRF)?

There is no fixed version for ip.

*
  • H
Server-side Request Forgery (SSRF)

ip is a Node library.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the isPublic function, by failing to identify hex-encoded 0x7f.1 as equivalent to the private addess 127.0.0.1. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.

How to fix Server-side Request Forgery (SSRF)?

Upgrade ip to version 1.1.9, 2.0.1 or higher.

<1.1.9 >=2.0.0 <2.0.1
Go back to all versions of this package