Listen to this Post
The `ip-address` library’s `Address6.isLinkLocal()` method incorrectly identifies link-local addresses. It checks for `fe80::/64` instead of the correct `fe80::/10` range. Link-local unicast is defined as the entire `/10` prefix under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry. The method compares the first 64 bits of an address against a literal string that only matches fe80:0000:0000:0000, so it accepts only 2⁶⁴ of the 2¹¹⁸ addresses in fe80::/10. As a result, addresses like fe81::1, fe8f::1, and `febf::1` are not recognized as link-local, even though they should be. The library contradicts itself: `getType()` returns ‘Link-local unicast’ for these addresses, `getScope()` returns ‘Link local’, and `isHostInSubnet(new Address6(‘fe80::/10’))` returns true, while `isLinkLocal()` returns false. This inconsistency allows an attacker to bypass SSRF filters that rely on isLinkLocal(). An application using this method to block internal requests would allow requests to link-local addresses outside the `fe80::/64` range. This can lead to access to neighboring machines or the on-link router on the server’s own segment. The vulnerability affects all versions up to 10.5.0. The fix involves testing against `fe80::/10` using the `isHostInSubnet` predicate.
DailyCVE Form:
Platform: ip-address
Version: <= 10.5.0
Vulnerability: SSRF bypass
Severity: Medium
date: Not specified
Prediction: Unknown
What Undercode Say:
npm i [email protected]
const { Address6 } = require('ip-address');
function isBlocked(host) {
const a = new Address6(host);
return a.isLoopback() || a.isLinkLocal() || a.isPrivate() || a.isMulticast() || a.isUnspecified();
}
for (const h of ['fe80::1', 'fe81::1', 'febf::1', 'fe80:0:0:1::1']) {
const a = new Address6(h);
console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h, '-> getType()', a.getType());
}
Exploit: (Educational Purposes!)
const { Address6 } = require('ip-address');
const target = 'fe81::1';
const address = new Address6(target);
console.log(address.isLinkLocal()); // false
console.log(address.getType()); // 'Link-local unicast'
// A guard using isLinkLocal() would allow this address.
Protection:
const LINK_LOCAL = new Address6('fe80::/10');
const linkLocal = new Address6(host).isHostInSubnet(LINK_LOCAL);
Impact:
Allows SSRF to link-local addresses outside fe80::/64, reaching hosts on the server’s own segment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
