PT-2024-2322 · Ip+4 · Ip+5

Published 2024-02-08 · Updated 2026-01-27 · CVE-2023-42282

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ip package versions prior to 1.1.9

Description The issue is related to the improper categorization of certain IP addresses as globally routable via the isPublic() function. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. The vulnerability may allow an attacker to execute arbitrary code and obtain sensitive information.

Recommendations For versions prior to 1.1.9, update to version 1.1.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the isPublic() function until a patch is available. Avoid using the isPublic() function with user input to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

AZL-34379

AZL-34380

AZL-34439

AZL-35042

BDU:2024-02261

CVE-2023-42282

GHSA-78XJ-CGH5-2H22

USN-6643-1

Affected Products

Bitbucket

Confluence

Debian

Linuxmint

Ubuntu

Ip

References · 43

• 🔥 https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html · Exploit
• 🔥 https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3 · Exploit
• https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-42282 · Security Note
• https://osv.dev/vulnerability/USN-6643-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34439 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42282 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34379 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-42282 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42282 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78xj-cgh5-2h22 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35042 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-42282 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42282 · Security Note
• https://osv.dev/vulnerability/AZL-34380 · Vendor Advisory