PT-2021-17985 · Npm · Netmask

John Jackson + 5 · Published 2021-03-28 · Updated 2024-02-11 · CVE-2021-28918

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: netmask npm package versions 1.0.6 and below netmask npm package versions 2.0.0

Description: The issue is related to improper input validation of octal strings in the netmask npm package, allowing unauthenticated remote attackers to perform server-side request forgery (SSRF), remote file inclusion (RFI), and local file inclusion (LFI) attacks. This vulnerability can be exploited to bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. The netmask package is used by over 270,000 projects and has around 3 million downloads per week.

Recommendations: For netmask npm package versions 1.0.6 and below: Upgrade to version 2.0.1 or later to ensure complete protection from this vulnerability. For netmask npm package version 2.0.0: Upgrade to version 2.0.1 or later, as the initial fix in version 2.0.0 was incomplete.

Exploit

Fix

Incorrect Type Conversion or Cast

RCE

Weakness Enumeration

CWE-704

CWE-20

Related Identifiers

CVE-2021-28918

GHSA-4C7M-WXVM-R7GC

GHSA-PCH5-WHG9-QR2R

Affected Products

Netmask

References · 32

• 🔥 https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md · Exploit
• 🔥 https://bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-29418 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-28918 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28918 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pch5-whg9-qr2r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4c7m-wxvm-r7gc · Vendor Advisory
• https://github.com/rs/node-netmask · Note
• https://github.com/rs/node-netmask/blob/98294cb20695f2c6c36219a4fbcd4744fb8d0682/CHANGELOG.md#v110-mar-18-2021 · Note
• https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4 · Note
• https://github.com/sickcodes/security · Note
• https://twitter.com/Ax_Sharma/status/1756919315628957743 · Twitter Post
• https://t.me/tmfeed/118292 · Telegram Post
• https://t.me/cybersecuritytechnologies/3057 · Telegram Post
• https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects · Note