Executive brief
The private-ip npm package is a library used to validate whether an IP address belongs to a private or reserved range, commonly relied upon to prevent server-side request forgery (SSRF) attacks. Versions 1.0.5 and below use inadequate regular expressions that fail to properly filter reserved IP ranges, allowing attackers to craft obfuscated requests to private IPs or ARIN-reserved addresses. This could allow attackers to access internal resources, extract sensitive data, or pivot to further compromise internal systems.
Technical details
The private-ip library uses regular expressions to detect whether a supplied IP address falls within reserved or private ranges (e.g., 10.0.0.0/8, 127.0.0.0/8, 192.168.0.0/16). The regex-based approach in versions ≤1.0.5 is insufficient and fails to account for: (1) variations of localhost using multiple zeros (e.g., 0000.0000.0000.0000), (2) ARIN-reserved IP ranges that have been designated since the package's creation, and (3) IPv6 loopback variations. This allows attackers to bypass IP filtering by crafting payloads that evaluate to private addresses but pass the flawed regex checks. The fixed version (2.0.0) replaces the regex logic with a netmask-based approach that performs byte-level IP containment checks against a comprehensive list of RFC-defined private and reserved ranges. No authentication or user interaction is required; any application using the vulnerable library to validate incoming IP addresses is affected.
Affected products
- npm private-ip <2.0.0
Timeline
- 2020-11-23: disclosed: CVE-2020-28360 published to NVD
- 2020-11-20: patched: Fix committed: replace regex with netmask validation
- 2021-04-13: advisory: GHSA-43ch-2h55-2vj7 published