CVE-2024-29415

HIGH NUCLEI

ip package <2.0.1 - SSRF

Title source: llm

Description

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Exploits (1)

nomisec WRITEUP 1 stars
by felipecruz91 · poc
https://github.com/felipecruz91/node-ip-vex

Nuclei Templates (1)

Atlassian Confluence XSLT Macro - Server-Side Request Forgery
HIGHVERIFIEDby ritikchaddha
FOFA: icon_hash="-305179312"

References (4)

Scores

CVSS v3 8.1
EPSS 0.8460
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-918 CWE-941
Status published
Products (1)
npm/ip 0npm
Published May 27, 2024
Tracked Since Feb 18, 2026