Server-Side Request Forgery (SSRF) Affecting private-ip package, versions *

private-ip is a Check if IP address is private.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.

1. Define an app.js file with the programmatic API of private-ip as follows:

import is_ip_private from 'private-ip'
import ipaddr from 'ipaddr.js'

// -- private-ip
console.log(is_ip_private('127.0.0.1'))
console.log(is_ip_private('10.0.0.0'))
console.log(is_ip_private('169.254.0.1'))
console.log(is_ip_private('239.255.255.250'))
// -- ipaddr.js
console.log(ipaddr.parse('127.0.0.1').range())
console.log(ipaddr.parse('10.0.0.0').range())
console.log(ipaddr.parse('169.254.0.1').range())
console.log(ipaddr.parse('239.255.255.250').range())

2. Run the app.js file

3. Observe that the private-ip package does not detect the multicast IP address 239.255.255.250 as a private IP address and returns true for all 4 checks.

• Github Gist