Description (CNA)
The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| librasean / IP-Utils | affected 0 through 2.4.0 |
CWE
CWE-180
References
- https://github.com/librasean/IP-Utils/blob/4f88799f94f21efe6ea9135129ab2bbeb0c58edc/src/IsPrivate.ts#L4
- https://gist.github.com/aydinnyunus/4d71e7d9a433f3afc658724b903f4d23
ADP enrichment
No English description supplied.
No references supplied.