CVE-2024-29415: problem solution

an illustrative note on the relationship logic between Enterprise and OSS based on a specific issue

If you've landed on this page, it's likely that your codebase relies on a widely deployed package that is currently struggling to maintain and is therefore vulnerable to certain scenarios. You have several strategies to follow:

• Apply patches locally


• Override internal registry versions


• Consider migrating to other solutions


• Just live with it

It's always a question of rational choice and cost of effort. In our case, the dependency tree profile required too much cascading fixes including external components, so we decided to take matters into our own hands — create a fully compatible alternative and apply it to our systems.

We found that the address classification error (private/public) was due to a lack of strictness in the parser implementation, and the format error was interpreted as a sign of being in (or out of) the range. An additional complication was that the logic was divided into several auxiliary functions, but was combined differently in the compositions of parsing addresses of different notations.

Algorithm

const SPECIALS: Record<Special, string[]> = {

  loopback: [

    '127.0.0.0/8',    // IPv4 loopback

    '::1/128',        // IPv6 loopback

  ],

  // ...

]

const SPECIAL_MATCHERS: ((addr: Address) => Special | undefined)[] = []

for (const [cat, cidrs] of Object.entries(SPECIALS)) {

  for (const cidr of cidrs) {

    for (const x of ipv6fySubnet(cidr)) {

      const subnet = Address.cidrSubnet(x)

      SPECIAL_MATCHERS.push((addr: Address) => addr.family === subnet.family && subnet.contains(addr) ? (cat as Special) : undefined)

    }

  }

}

Compatibility

The key point was to keep backward compatibility. To ensure this, we completely how similar other IP tools are in their operating logic. The conclusion is obvious: without additional modifications, it is impossible to achieve equivalent operating results in all scenarios. It was also important for us to make sure that the library functionality would not differ in different versions of runtimes and would be compatible with the browser environment.