CVE-2023-42282 #138

Cofgren · 2024-02-12T02:53:38Z

Hi,

I've made a patch for CVE-2023-42282 (handling of 0x7f.1 address in isPrivate).

Please review and merge if ok.

Thanks.

indutny · 2024-02-12T03:06:40Z

Thanks for the fix! Could you elaborate on what RFC marks 0x7f.0.0.1 as a valid IPv4 address, and in what way this value can reach the Node.js application that uses this module?

If we go this way - we probably want to add support for other private IP address (192.xxx, 10.xxx).

mnikolaus · 2024-02-12T10:01:33Z

.gitignore

+# Jetbrains IDE
+.idea/


This should probably be removed, we don't want to pollute repo with opinionated files

This does exactly what you mentioned: it prevents the repo from being polluted with opinionated files by adding them into .gitignore

As no other IDE's files are listed here, adding a single one can be seen as opinionated. This addition makes sense, just not without the inclusion of other IDE's config dirs - and definately not as part of this merge request.

Developers can just as easily add the entry/entries corresponding to their editor of choice to the local .git/config file.

I see your point, yes that makes more sense.

Because a lot of people don't realize this and might find the info helpful:

These kinds of things can be placed in a .gitignore in a parent directory, such as (typically) your home directory. (If you're a macOS user, you probably want a .gitignore file in your home directory with an entry for .DS_Store.)

mnikolaus · 2024-02-12T10:03:12Z

lib/ip.js

@@ -311,8 +311,8 @@ ip.isEqual = function (a, b) {
 };

 ip.isPrivate = function (addr) {
-  return /^(::f{4}:)?10\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/i
-    .test(addr)
+  return /^0x7f/i.test(addr)


This only checks for a single address and not the whole network

Ideally, input should be sanitized and form a standard ipv4 or ipv6 dot notation, or be rejected and the function fail (see previous comments).

The regex checks if the first octet begins with 0x7f, which should cater for 127.0.0.0/8.

You are right, misread it... But this approach introduces some other issues w/o addr being sanitised before. You do not check the entire IP so you could easily have something like

0x7f.1.1.1.1.1

being labeled as correct IP and isPrivate would return true

Indeed, the octal and hex parts should be converted to integers first, similarly to #138 (comment)

Cofgren · 2024-02-12T12:33:13Z

Thanks for the fix! Could you elaborate on what RFC marks 0x7f.0.0.1 as a valid IPv4 address, and in what way this value can reach the Node.js application that uses this module?

If we go this way - we probably want to add support for other private IP address (192.xxx, 10.xxx).

There's another discussion about what the function should return if the input is invalid, as semantically, neither public nor private would apply and should probably be an exception. I agree that it peculiar to have mixed hex and dot notation, but that's the crux of the issue - that invalid input to this function is at the root of the CVE.

Cofgren · 2024-02-12T13:34:43Z

As a bit of background on where the '0x7f.1' came from...

Here is an interesting article that talks about fun with IP addresses using mixed notation

Historically, some ip utilities support this way of writing IPv4 addresses. Note the handling of 1, 2 or 3 dots in the ping source.
Source for ping that shows the use of strtoul being called on each octet

Man page for strtoul that shows support for hex and octal

This shows how to handle conversion of ipv4 into 32-bit address, and how to interpret a.b, a.b.c and a.b.c.d.
Implementation of inet_aton

To support this in the library, perhaps sanitize the addr input into a standard notation, then use the existing regexes, which seem to expect 4 octets.

levpachmanov · 2024-02-12T15:47:00Z

Hi @Cofgren @indutny ,

We have created a slightly different patch at @seal-community - I will appreciate your feedback.

n0099 · 2024-02-12T23:08:00Z

https://stackoverflow.com/a/38948504/12576620

ping -c1 216.58.195.238
ping -c1 0xd8.0x3a.0xc3.0xee
ping -c1 0330.072.0303.0356
ping -c1 216.58.50158
ping -c1 0330.072.0141756
ping -c1 0xd8.0x3a.0xc3ee
ping -c1 216.3851246
ping -c1 0330.016541756
ping -c1 0xd8.0x3ac3ee
ping -c1 3627729902
ping -c1 033016541756
ping -c1 0xd83ac3ee
ping -c1 0xd8.072.195.0xee

https://knowyourmeme.com/memes/theyre-the-same-picture

### Feature or Bugfix - Bugfix ### Detail - Add `.nsprc` file for ignored vulnerabilities in `better-npm-audit`. - Added `ip` package to ignored vulnerabilities with expiration 2024/02/28: https://www.cve.org/CVERecord?id=CVE-2023-42282 The vulnerability found in `ip` affects us because we use the `react-native-community/cli` package. In this package repository an [issue reporting the vulnerabilty](react-native-community/cli#2294) was already raised. Update: `ip` team is working on a fix: indutny/node-ip#138 ### Relates - https://www.cve.org/CVERecord?id=CVE-2023-42282 ### Security Please answer the questions below briefly where applicable, or write `N/A`. Based on [OWASP 10](https://owasp.org/Top10/en/). - Does this PR introduce or modify any input fields or queries - this includes fetching data from storage outside the application (e.g. a database, an S3 bucket)? - Is the input sanitized? - What precautions are you taking before deserializing the data you consume? - Is injection prevented by parametrizing queries? - Have you ensured no `eval` or similar functions are used? - Does this PR introduce any functionality or component that requires authorization? - How have you ensured it respects the existing AuthN/AuthZ mechanisms? - Are you logging failed auth attempts? - Are you using or adding any cryptographic features? - Do you use a standard proven implementations? - Are the used keys controlled by the customer? Where are they stored? - Are you introducing any new policies/roles/users? - Have you used the least-privilege principle? How? By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

damonholden · 2024-02-13T10:27:57Z

How is this PR looking guys? Code reviews don't point out any immediate issues.

aminekun90 · 2024-02-13T10:34:41Z

How is this PR looking guys? Code reviews don't point out any immediate issues.
it seems that it is not covering all cases maybe @mnikolaus or @levpachmanov can elaborate

mnikolaus · 2024-02-13T10:45:48Z

I guess this comment is blocking

I would definitely opt for more tests, even the tests in this PR are happy-path only...

There is a great point raised by OP in this comment, there are exposed methods that would benefit calling sanitise before doing processing

mixmix · 2024-02-13T20:34:16Z

possible option - don't solve this completely, solve it incrementally:

throw an error if there is any weird octal junk that comes in
merge and publish a new version

This closes the CVE problem at least. In the meantime, consumers can write their own sanitizers if they need them. In time a PR that's nice and magically solves all the hard cases may emerge, but it significantly reduces the work and pressure on the (unpaid) maintainers of this module

jwasnoggin · 2024-02-13T22:25:34Z

possible option - don't solve this completely, solve it incrementally:

throw an error if there is any weird octal junk that comes in

merge and publish a new version

This closes the CVE problem at least. In the meantime, consumers can write their own sanitizers if they need them. In time a PR that's nice and magically solves all the hard cases may emerge, but it significantly reduces the work and pressure on the (unpaid) maintainers of this module

Something like

if (!isV4Format(addr) && !isV6Format(addr)) {
  // throw error
}

seems like a simple way to do that

Cofgren · 2024-02-14T03:52:40Z

Thanks for reviews and comments. Please review these latest commits and let me know if I've missed anything. I've tried to keep it compatible while adding support to interpret octets in a way that aligns with how the ping utility handles it. Changes are in isPrivate and isLoopback, along with a new function normalizeToLong.

NaveenAutomate · 2024-02-14T13:27:53Z

Any chance we can get this prioritised considering the cve marked as high and blocking for many people!
Thanks in advance?

taylorjdawson · 2024-02-14T16:56:08Z

Hi @Cofgren @indutny ,

We have created a slightly different patch at @seal-community - I will appreciate your feedback.

Has anyone compared this PR with this suggested patch from @seal-community?

Cofgren · 2024-02-15T07:31:56Z

Hi @Cofgren @indutny ,
We have created a slightly different patch at @seal-community - I will appreciate your feedback.

Has anyone compared this PR with this suggested patch from @seal-community?

Yes, but I haven't tested their patch. They approach it differently by removing the regex for matching the various CIDRs, which probably would perform better, but is a larger deviation from the original implementation. Further, I'm not sure their parsing of the octets will result in the same behaviour. Their parsing of octals may not pickup octal format issues due to the behaviour of parseInt(blah, 8).

Cofgren · 2024-02-15T07:34:35Z

Just wanted to see what are next steps - the PR seems to be approved.

abhishek-parative · 2024-02-17T18:42:59Z

What is the timeline to get this patch pushed out?

llago-atlassian · 2024-02-19T00:08:05Z

+1

joelicatajr · 2024-02-19T00:57:16Z

+1

glitch-txs · 2024-02-19T02:15:26Z

I would suggest replacing the library, it seems like this is not being actively maintained.

indutny

LGTM

indutny · 2024-02-19T04:30:02Z

Merged in 6a3ada9, and released in 1.1.9. Many thanks, and sorry for the wait!

ericlu88 · 2024-02-19T05:07:34Z

@indutny would you be releasing a 2.0.1 as well? btw what's the difference between the 2.x series?

indutny · 2024-02-19T05:13:52Z

2.0.1 is out! The difference is that 2.x uses Buffer.alloc, while the 1.x still uses new Buffer.

mukitmomin · 2024-02-19T17:34:38Z

The CVE reported in the github advisory database is not written correctly. NPM does not accept version v1.1.9 as a patched version as the existing CVE lists affected versions are <=2.0.0. This PR fixes the advisory to accept v1.1.9 as a patched version as well. Any idea when/how CVE can be updated?

Trott · 2024-02-19T18:45:50Z

The CVE reported in the github advisory database is not written correctly. NPM does not accept version v1.1.9 as a patched version as the existing CVE lists affected versions are <=2.0.0. This PR fixes the advisory to accept v1.1.9 as a patched version as well. Any idea when/how CVE can be updated?

Having the CVE present correct information is important, of course. And I know people don't typically control what's deep in their dependency trees. But in case it helps anyone update with confidence:

Unless you need to support a Node.js version older than 5.x, updating to ip@2.0.1 should be seamless. And if you need to support a version of Node.js older than 5.x, you are likely dealing with dozens of High and Critical CVEs in addition to this one.

ouuan · 2024-02-21T06:46:03Z

Unfortunately, this does not completely address the CVE. There are many more cases not covered. See #143.

Luke McFarlane added 3 commits February 12, 2024 11:47

updated .gitignore

f668b59

lib: fixed CVE-2023-42282 and added unit test

10b0e2f

lib: fixed CVE-2023-42282 and added unit test

e396dfd

mnikolaus reviewed Feb 12, 2024

View reviewed changes

aminekun90 mentioned this pull request Feb 12, 2024

fix: update dependencies aminekun90/mdns_listener_advanced#17

Merged

github-actions bot mentioned this pull request Feb 12, 2024

Snyk vulnerability [SNYK-JS-IP-6240864] backstage/backstage#22864

Closed

mukitmomin mentioned this pull request Feb 12, 2024

🚨 HIGH Severity Vulnerability: Package unsafe for use as of v1.1.8 🚨 #136

Open

dlpzx mentioned this pull request Feb 13, 2024

Add nsprc file to npm-audit with expiration for ip vulnerability data-dot-all/dataall#1056

Merged

sanitized .gitignore

a395cff

Luke McFarlane added 3 commits February 14, 2024 14:11

normalize ipv4 addresses prior to regex

0b9a13d

added 2130706433 (127.0.0.1) to isLoopback

a1fea99

handle long as input in isLoopback + more tests

990382e

jviehhauser approved these changes Feb 14, 2024

View reviewed changes

kwasniew mentioned this pull request Feb 14, 2024

Replace vulnerable ip dependency Unleash/unleash-client-node#586

Closed

jiyoonie9 mentioned this pull request Feb 16, 2024

Update ip package once it gets patched TBD54566975/tbdex-js#173

Closed

indutny approved these changes Feb 19, 2024

View reviewed changes

indutny closed this Feb 19, 2024

drik98 mentioned this pull request Feb 19, 2024

Core: Update ip version to fix CVE-2023-42282 storybookjs/storybook#26086

Merged

8 tasks

jase88 mentioned this pull request Feb 19, 2024

[Bug]: The latest version depends on the highly vulnerable ip package storybookjs/storybook#26014

Closed

iFreilicht mentioned this pull request Feb 19, 2024

[GHSA-78xj-cgh5-2h22] NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks github/advisory-database#3553

Merged

marcomontalbano mentioned this pull request Feb 19, 2024

Solve CVE-2023-42282 vulnerability commercelayer/drop-in.js#60

Merged

3 tasks

iFreilicht mentioned this pull request Feb 19, 2024

[GHSA-78xj-cgh5-2h22] NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks github/advisory-database#3550

Closed

fshenton mentioned this pull request Feb 19, 2024

[GHSA-78xj-cgh5-2h22] NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks github/advisory-database#3554

Closed

mdoelker mentioned this pull request Feb 19, 2024

[GHSA-78xj-cgh5-2h22] NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks github/advisory-database#3555

Closed

vintagesucks mentioned this pull request Feb 20, 2024

[GHSA-78xj-cgh5-2h22] NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks github/advisory-database#3583

Closed

This was referenced Feb 21, 2024

lib: fix parsing for ill-formed addresses #143

Draft

[GHSA-78xj-cgh5-2h22] NPM IP package incorrectly identifies some private IP addresses as public github/advisory-database#3617

Closed

This was referenced Apr 9, 2024

Fix CVE–2023–42282 AnExampleCompany/Repo1#58

Open

Fix CVE–2023–42282 OS2iot/OS2iot-frontend#157

Merged

This was referenced Apr 20, 2024

Fix CVE–2023–42282 garbsam97/Material-Design-Web---Node-Template#1

Merged

Fix CVE–2023–42282 garbsam97/harnesscd-example-apps#1

Open

Fix CVE–2023–42282 garbsam97/BackPress#1

Open

n0099 mentioned this pull request Jul 22, 2024

[Bug] 上古老铁 tid=25084945 无法用 client.get_posts() 查出数据。 lumina37/aiotieba#213

Closed

caputomarcos mentioned this pull request Aug 29, 2024

Fix bugs in ip and socket.io packages to improve security and stability frangoteam/FUXA#1340

Closed

CVE-2023-42282 #138

CVE-2023-42282 #138

Conversation

Cofgren commented Feb 12, 2024

indutny commented Feb 12, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mnikolaus Feb 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Cofgren commented Feb 12, 2024

Cofgren commented Feb 12, 2024 • edited Loading

levpachmanov commented Feb 12, 2024

n0099 commented Feb 12, 2024

damonholden commented Feb 13, 2024

aminekun90 commented Feb 13, 2024

mnikolaus commented Feb 13, 2024 • edited Loading

mixmix commented Feb 13, 2024

jwasnoggin commented Feb 13, 2024

Cofgren commented Feb 14, 2024 • edited Loading

NaveenAutomate commented Feb 14, 2024

taylorjdawson commented Feb 14, 2024

Cofgren commented Feb 15, 2024

Cofgren commented Feb 15, 2024

abhishek-parative commented Feb 17, 2024

llago-atlassian commented Feb 19, 2024

joelicatajr commented Feb 19, 2024

glitch-txs commented Feb 19, 2024

indutny left a comment

Choose a reason for hiding this comment

indutny commented Feb 19, 2024

ericlu88 commented Feb 19, 2024

indutny commented Feb 19, 2024

mukitmomin commented Feb 19, 2024

Trott commented Feb 19, 2024 • edited Loading

ouuan commented Feb 21, 2024 • edited Loading

mnikolaus Feb 13, 2024 •

edited

Loading

Cofgren commented Feb 12, 2024 •

edited

Loading

mnikolaus commented Feb 13, 2024 •

edited

Loading

Cofgren commented Feb 14, 2024 •

edited

Loading

Trott commented Feb 19, 2024 •

edited

Loading

ouuan commented Feb 21, 2024 •

edited

Loading