CVE-2024-29415

Published: May 27, 2024Modified: Jun 17, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Incorrectly Specified Destination in a Communication Channel

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

References (7)

https://github.com/indutny/node-ip/issues/150

Source: cve@mitre.org

https://github.com/indutny/node-ip/pull/143

Source: cve@mitre.org

https://github.com/indutny/node-ip/pull/144

Source: cve@mitre.org

https://github.com/indutny/node-ip/issues/150

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/indutny/node-ip/pull/143

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/indutny/node-ip/pull/144

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20250117-0010/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.