projectdiscovery/nuclei · error

invalid base ip

Error message

invalid base ip

What it means

Raised by GetRandomIPWithCidr in pkg/protocols/common/randomip (randomip.go:45). After net.ParseCIDR succeeds, the function branches on the base IP: if the last mask byte is 255 the base is returned as-is; otherwise IPv4/IPv6 each get a random address in the net. The 'invalid base ip' branch is a defensive default for a parsed CIDR whose base IP classifies as neither IPv4 nor IPv6 via iputil. Most bad inputs (non-CIDR strings, bad masks) fail earlier inside ParseCIDR and return that error instead, so hitting this branch means an exotic, nearly-unreachable IP form.

Source

Thrown at pkg/protocols/common/randomip/randomip.go:45

	if !iputil.IsCIDR(cidr) {
		return nil, errors.Errorf("%s is not a valid cidr", cidr)
	}

	baseIp, ipnet, err := net.ParseCIDR(cidr)
	if err != nil {
		return nil, err
	}

	switch {
	case ipnet.Mask[len(ipnet.Mask)-1] == 255:
		return baseIp, nil
	case iputil.IsIPv4(baseIp.String()):
		return getRandomIP(ipnet, 4), nil
	case iputil.IsIPv6(baseIp.String()):
		return getRandomIP(ipnet, 16), nil
	default:
		return nil, errors.New("invalid base ip")
	}
}

func getRandomIP(ipnet *net.IPNet, size int) net.IP {
	ip := ipnet.IP
	var iteration int

	for iteration < maxIterations {
		iteration++
		ones, _ := ipnet.Mask.Size()
		quotient := ones / 8
		remainder := ones % 8
		var r []byte
		switch size {
		case 4, 16:
			r = make([]byte, size)
		default:
			return ip

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Pass a canonical CIDR such as 173.1.0.0/16 or 2001:db8::/32
2. Pre-validate with net.ParseCIDR and iputil.IsIPv4/IsIPv6 before calling the helper
3. If the input is dynamic, build it from trusted parts rather than string concatenation of user data

Example fix

// before
ip := randomip.GetRandomIPWithCidr(userSupplied)
// after
if _, _, err := net.ParseCIDR(userSupplied); err != nil { return err }
ip, err := randomip.GetRandomIPWithCidr(userSupplied)

func cidrOK(s string) bool {
    _, ipnet, err := net.ParseCIDR(s)
    if err != nil { return false }
    base := ipnet.IP
    return iputil.IsIPv4(base.String()) || iputil.IsIPv6(base.String())
}

When it happens

Trigger: Passing an unusual CIDR whose base IP defeats iputil.IsIPv4/IsIPv6 classification (e.g. IPv4-mapped or degenerate forms produced by dynamic string building in a template); in practice most users who see it passed a malformed expression into rand_ip() that happened to parse.

Common situations: The rand_ip() DSL helper fed with a variable-built CIDR string; copy-paste of an IPv6 CIDR with zone or embedded dashes; unit tests constructing synthetic IPNet values.

Related errors

• unresolved variables found: %s
• invalid dns type
• validation failed for these fields
• no input provider found
• host concurrency must be at least 1

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/d5fdfc92eb94094c. Report an issue: GitHub.