Executive brief
The NPM ip library, a widely-used JavaScript package for IP address validation, incorrectly classifies certain private IP addresses written in uncommon formats (such as hexadecimal notation) as public. This misclassification can enable Server-Side Request Forgery (SSRF) attacks if applications use the library to validate and restrict network requests to public addresses only, allowing attackers to reach internal servers they should not access.
Technical details
The vulnerability lies in the isPublic() function of the NPM ip package, which fails to properly validate IP addresses in non-standard formats such as 0x7F.1 (hexadecimal representation of 127.0.0.1). The function incorrectly returns true for these addresses, reporting them as public when they are actually private. An attacker can exploit this by crafting malformed IP addresses and passing them to applications that rely on isPublic() to enforce access controls, bypassing protections against SSRF attacks. The vulnerability affects versions prior to 1.1.9 and 2.0.0; fixes are available in versions 1.1.9 and 2.0.1. The attack requires no authentication and only requires the application to use the affected function with untrusted input.
Affected products
- npm ip before 1.1.9; 2.0.0 before 2.0.1
Timeline
- 2024-02-08: disclosed