REDHAT-BUG-2476810: High severity npm/ip-address vulnerability
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ip-addressto a version that resolves this vulnerability.Fixed in 10.1.1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An application must pass untrusted input to Address6 and render the result of Address6.group(), Address6.link(), or a thrown error's parseMessage as HTML, such as through innerHTML. If those values are not rendered as HTML, the described cross-site scripting path is not present.
Are applications using the library's default behavior automatically exposed?
No. Exposure depends on application behavior: attacker-controlled input must reach Address6 and one of the affected returned or error values must be inserted into an HTML-rendering context without escaping.
Which versions are affected and what version contains the fix?
Versions prior to 10.1.1 are affected. The issue is fixed in version 10.1.1.
What can be done if upgrading is not immediately possible?
Do not insert output from Address6.group(), Address6.link(), or AddressError.parseMessage into HTML contexts. Render it as text or ensure attacker-controlled content is HTML-escaped before insertion.