CVE-2023-42282: SSRF
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
https://cosmosofcyberspace.github.io/npmipcve/npmipcve.html https://github.com/indutny/node-ip
Other sources
The isPublic() function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.
— GitHub
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/node-ipto a version that resolves this vulnerability.Fixed in 1.1.5-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/node-ipto a version that resolves this vulnerability.Fixed in 1.1.5-5ubuntu0.1~ - Upgrade
Upgrade
ubuntu/node-ipto a version that resolves this vulnerability.Fixed in 1.1.5+~1.1.0-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/node-ipto a version that resolves this vulnerability.Fixed in 2.0.0+~1.1.0-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/node-ipto a version that resolves this vulnerability.Fixed in 1.1.9Fixed in 2.0.1 - Upgrade
Upgrade
npm/ipto a version that resolves this vulnerability.Fixed in 1.1.9 - Upgrade
Upgrade
npm/ipto a version that resolves this vulnerability.Fixed in 2.0.1 - Upgrade
Upgrade
redhat/nodejs-ipto a version that resolves this vulnerability.Fixed in 1.1.9 - Upgrade
Upgrade
redhat/nodejs-ipto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42282?
CVE-2023-42282 is classified as a high-severity vulnerability due to its potential to execute arbitrary code and access sensitive information.
How do I fix CVE-2023-42282?
To mitigate CVE-2023-42282, upgrade to node-ip version 1.1.9 or higher, or 2.0.1 for upstream packages.
Which software packages are affected by CVE-2023-42282?
CVE-2023-42282 affects the NPM IP package versions 1.1.8 and below, as well as various versions of node-ip on Debian and Ubuntu systems.
What specific function in the NPM IP Package is vulnerable in CVE-2023-42282?
The isPublic() function in the NPM IP Package is the specific point of vulnerability in CVE-2023-42282.
Are there any notable products impacted by CVE-2023-42282?
Yes, IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP3 are impacted by CVE-2023-42282.