Closed
Description
NPM ip package is vulnerable to Server-Side Request Forgery (SSRF) attacks, see GitHub advisory for more information.
Effected packages:
-
@react-native-community/[email protected]includes ip in the package.json file but doesn't appear to be used in the code itself. -
@react-native-community/[email protected]:
It looks like theip.isPublicisn't explictly used within the@react-native-community/[email protected]pkg:However,
ip.addressdoes callip.isPublicunder the hood://... return name === 'public' ? ip.isPrivate(details.address) : ip.isPublic(details.address); });
Could potentially introduce a function to check that the IP address isn't private or reserved using the ipaddr.js lib
// Function to check if the IP address is safe to use (not private or reserved)
function isSafeIPAddress(ipAddress) {
try {
const addr = ipaddr.parse(ipAddress);
// Check if the IP address is in a private or reserved range
const range = addr.range();
return range !== 'private' && range !== 'loopback' && range !== 'linkLocal' && range !== 'uniqueLocal';
} catch (e) {
console.error("Error parsing IP address:", e);
return false; // Consider the IP address unsafe if it cannot be parsed
}
}