cve/2023/CVE-2023-42282.md

CVE-2023-42282

Description

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

POC

Reference

• https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
• https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/

Github

• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/seal-community/patches
• https://github.com/vin01/bogus-cves