N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-42282

CVE-2023-42282: NPM IP package incorrectly identifies some private IP addresses as public

The isPublic() function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-42282

CVE-2023-42282:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ip	npm	= 2.0.0	2.0.1
ip	npm	< 1.1.9	1.1.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is that the isPublic() function in the 'ip' package incorrectly classifies certain private IP addresses in non-standard formats (like '0x7F.1') as public.

The isPublic function's logic is simply !ip.isPrivate(addr). Therefore, the incorrect behavior of isPublic is a direct result of isPrivate failing to correctly identify these non-standard IP formats as private.

The patches (commits 32f468f1245574785ec080705737a579be1223aa and 6a3ada9b471b09d5f0f5be264911ab564bf67894) address this by overhauling ip.isPrivate. The changes include:

Introducing a new function ip.normalizeToLong(addr) to parse various IP notations (decimal, hex, octal, different numbers of parts) into a standard numerical representation.
Modifying ip.isPrivate to use this normalization for IPv4 addresses before performing checks.
Enhancing ip.isLoopback to correctly identify loopback addresses in these non-standard formats and calling this improved isLoopback at the beginning of ip.isPrivate.

Thus, ip.isPrivate is identified as a vulnerable function because it contained the defective IP address recognition logic. ip.isPublic is also identified as vulnerable because it directly exposed this flawed logic, leading to the reported security issue. Both functions process the potentially problematic IP address input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.