CVE-2024-29415

HIGH NUCLEI

Node ip package <=2.0.1 - Server-Side Request Forgery via IP Misclassification

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2024-29415. PoCs published by felipecruz91, bybraveHQ. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository demonstrates the use of VEX (Vulnerability Exploitability eXchange) to suppress CVE-2024-29415 in a Docker image containing the vulnerable `node-ip` package. It includes steps to generate a VEX document and verify its effectiveness using Docker Scout.

Description

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Exploits (2)

nomisec WRITEUP 1 stars
by felipecruz91 · poc
https://github.com/felipecruz91/node-ip-vex

This repository demonstrates the use of VEX (Vulnerability Exploitability eXchange) to suppress CVE-2024-29415 in a Docker image containing the vulnerable `node-ip` package. It includes steps to generate a VEX document and verify its effectiveness using Docker Scout.

Classification
Writeup 100%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Theoretical
Target: node-ip npm package <=2.0.1
No auth needed
Prerequisites: Docker · Docker Scout · vexctl · node-ip package in the project
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by bybraveHQ · poc
https://github.com/bybraveHQ/ip2

This repository provides a patched version of the `ip` Node.js library, fixing CVE-2024-29415, a security flaw where non-canonical IP address formats (e.g., octal, hex, abbreviated IPv4) were incorrectly classified as public, leading to potential SSRF bypasses. The fix enforces strict parsing and throws errors on malformed inputs instead of misclassifying them.

Classification
Working Poc 98%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: Node.js ip library (versions prior to 3.0.0)
No auth needed
Prerequisites: Use of the vulnerable `ip` library for IP address classification in a security-sensitive context (e.g., SSRF protection)
mistral-large-3 · analyzed Jul 05, 2026 Full analysis →

Nuclei Templates (1)

Atlassian Confluence XSLT Macro - Server-Side Request Forgery
HIGHVERIFIEDby ritikchaddha
FOFA: icon_hash="-305179312"

References (4)

Core 4

Scores

CVSS v3 8.1
EPSS 0.0828
EPSS Percentile 94.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-918 CWE-941
Status published
Products (1)
npm/ip 0npm
Published May 27, 2024
Tracked Since Feb 18, 2026