CVE-2023-42282: Node.js IP Package SSRF Vulnerability

CVE-2023-42282 Overview

The ip package before version 1.1.9 for Node.js potentially allows Server-Side Request Forgery (SSRF). Certain IP addresses, such as 0x7f.1, may be incorrectly categorized as globally routable due to flaws in the isPublic function.

Critical Impact
This vulnerability can lead to sensitive information exposure and unauthorized access to internal networks.

Affected Products

Fedorindutny ip

Discovery Timeline

2024-02-08T17:15:10.840 - CVE CVE-2023-42282 published to NVD
2025-05-15T20:15:26.367 - Last updated in NVD database

Technical Details for CVE-2023-42282

Vulnerability Analysis

The vulnerability stems from incorrect categorization of certain IP addresses, leading the isPublic function to return true for addresses that should be private. This can be exploited to perform SSRF attacks.

Root Cause

The root cause is the improper handling and interpretation of special notations in IP addresses within the isPublic API.

Attack Vector

This vulnerability can be exploited remotely over the network without authentication, using specially crafted IP addresses.

javascript

// Example exploitation code (sanitized)
const ip = require('ip');

const checkIp = '0x7f.1';
if (ip.isPublic(checkIp)) {
    console.log('This IP is improperly marked as public.');
} else {
    console.log('Correctly identified as private.');
}

Detection Methods for CVE-2023-42282

Indicators of Compromise

Unexpected outbound network connections
Access logs showing special notation IPs
Unusual traffic patterns from internal servers

Detection Strategies

Monitor logs for unusual IP address formats and outbound requests that could indicate SSRF attempts.

Monitoring Recommendations

Implement continuous monitoring of network traffic and deploy anomaly detection systems to capture unusual access patterns.

How to Mitigate CVE-2023-42282

Immediate Actions Required

Upgrade to ip version 1.1.9 or later.
Restrict application access to known and trusted internal IPs only.
Implement network firewall rules to block requests to/from suspicious IPs.

Patch Information

Apply the patch available at GitHub Commit.

Workarounds

Restrict IP address verifications to well-known, non-ambiguous formats.

bash

# Configuration example
echo '127.0.0.1 localhost' >> /etc/hosts  # Ensure localhost points locally