> CVE-2020-28360: npm private-ip SSRF Bypass (IP Phone Home)

Credits Sick.Codes Github: (https://github.com/sickcodes) Twitter: (https://twitter.com/sickcodes) John Github: (https://github.com/johnjhacking) Nick Sahler Github: (https://github.com/nicksahler) Twitter: (https://twitter.com/tensor_bodega) With Collaboration from: Harold Hunt LinkedIn: (https://www.linkedin.com/in/huntharo) Identification Over the course of several months, John dealt with remediating a Server-Side Request Forgery vulnerability, several times. A researcher was able to bypass blocking mechanisms, therefore John decided to dig in further to get to the root cause of the vulnerability. The researcher used the following payload to bypass restrictions: