8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-29415

CVE-2024-29415: ip SSRF improper categorization in isPublic

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-29415

CVE-2024-29415:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ip	npm	<= 2.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-29415) states that the ip package improperly categorizes certain IP addresses as globally routable via the isPublic function. This miscategorization can lead to Server-Side Request Forgery (SSRF).

The analysis of the provided commit information (specifically from pull request #144, which includes commit 94f82bd4f2bace0c228bbbfe70073a71536fcbdf) reveals that the core issue lay in how the ip.isPrivate and ip.isLoopback functions parsed and normalized various non-standard IP address formats (e.g., '127.1', '01200034567', '012.1.2.3', '::ffff:127.0.0.1').

ip.isPublic is directly implicated as it relies on !ip.isPrivate(). If isPrivate is wrong, isPublic is wrong.
ip.isPrivate contained complex logic, including calls to ip.normalizeToLong and, in earlier versions or implicitly, relied on ip.isLoopback. The patches show this internal logic being replaced by a call to a new ip.normalize() (later ip.normalizeStrict()) function that uses the Node.js net module for more reliable IP parsing.
ip.isLoopback also had its own parsing for octal, hexadecimal, and long integer IP formats, which was flawed and replaced by the new normalization approach.

The vulnerable functions are those that performed the incorrect categorization due to flawed input processing. The patches fundamentally changed this processing by removing custom, error-prone parsing logic from these functions and delegating normalization to a more robust mechanism. The examples provided in the CVE (like '127.1', '01200034567') highlight inputs that the old parsing logic in isPrivate and isLoopback would misinterpret, leading isPublic to an incorrect conclusion.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.