CVE-2021-28918

 

Published at: - 01-04-2021 03:15

Last modified: - 31-03-2022 06:52

Total changes: - 6

Description

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

 

Verification logic

 

Reference

• https://github.com/rs/node-netmask
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
• https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
• https://www.npmjs.com/package/netmask
• https://github.com/advisories/GHSA-pch5-whg9-qr2r
• https://security.netapp.com/advisory/ntap-20210528-0010/
• https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/

 

Keywords

NVD

 

CVE-2021-28918

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures