Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-29415 is a high-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The ip package through version 2.0.1 for Node.js is affected by an SSRF vulnerability tracked as CVE-2024-29415. Certain non-standard IP address representations, including 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1, are incorrectly treated as globally routable by the isPublic function, allowing them to bypass intended restrictions. The flaw stems from an incomplete remediation of the earlier CVE-2023-42282 issue and carries a CVSS 3.1 score of 8.1 with CWE-918 and CWE-941 classifications.
An unauthenticated remote attacker can supply these crafted addresses to applications that rely on the package for IP classification, potentially enabling requests to internal or loopback resources that should have been blocked. Successful exploitation can result in unauthorized access to sensitive internal services or data exfiltration depending on how the calling application uses the isPublic result.
The referenced GitHub issues and pull requests in the node-ip repository document ongoing discussion of the categorization logic and prior attempts to address similar bypasses, though no separate vendor advisory or patch release is described in the available details. The EPSS score has reached a peak of 0.8805 with a current value of 0.8434, indicating sustained exploitation interest following disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1886
Vulnerability Data
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for…
more
CVE-2023-42282.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.6V1.5.3V5.3.2V10.4.7
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.
Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.
Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and change control prevent mis-specified endpoints from being deployed.
Secure development practices directly include input validation and destination allow-listing that prevent SSRF.
Network monitoring can detect traffic to wrong destinations but does not prevent the specification error itself.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Documented network data-flow diagrams directly reduce the chance of specifying an incorrect destination address.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect destinations, yet it is a detection rather than prevention control.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.
Network security controls enforce correct endpoint validation and routing, directly preventing mis-specified destinations.
Security of network services includes service endpoint verification, mitigating incorrect destination specification.
Network segregation reduces exposure but does not address destination specification within allowed segments.
Secure SDLC practices can catch destination errors during design, but coverage is indirect.