CVE-2024-29415: SSRF
Node.js ip module is vulnerable to server-side request forgery, caused by a flaw with IP addresses are improperly categorized as globally routable via isPublic. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.
Other sources
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29415?
CVE-2024-29415 has been classified as a critical vulnerability due to the potential for server-side request forgery attacks.
How do I fix CVE-2024-29415?
To mitigate CVE-2024-29415, upgrade the 'ip' module to version 2.0.2 or higher, or update to a more recent version of affected products.
What products are affected by CVE-2024-29415?
CVE-2024-29415 affects the 'ip' module (version 2.0.1 and below) and IBM Planning Analytics (version 2.1 and below).
What type of attack can be conducted using CVE-2024-29415?
An attacker can exploit CVE-2024-29415 to perform server-side request forgery (SSRF) attacks by sending specially crafted requests.
Who is the vendor for the affected 'ip' module related to CVE-2024-29415?
The 'ip' module related to CVE-2024-29415 is maintained by Indutny.