CVE-2021-29418: netmask npm package vulnerable to octal input data
Summary
CVE-2021-29418: netmask npm package mishandles octal input data. Affects netmask versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netmask package is a Node.js module that provides functionality for working with IP addresses and subnets. It allows developers to manipulate and analyze IP addresses, calculate network masks, and perform various network-related operations. However, versions before 2.0.1 of the netmask package have a vulnerability that mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This vulnerability can be exploited to bypass access control mechanisms based on IP addresses.
Vulnerability Detail
The vulnerability in the netmask package arises from an incomplete fix for CVE-2021-28918. It occurs when the package encounters unexpected characters in an IP address string, specifically octal digits. By providing an IP address with an octal digit of 9, an attacker can manipulate the netmask package to bypass IP-based access control. This can have serious consequences, as it allows unauthorized access to systems or resources that rely on IP address filtering. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
npm install netmask@2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the netmask package to the fixed version as soon as possible.
Conclusion
The netmask npm package is vulnerable to octal input data, allowing attackers to bypass IP-based access control. To mitigate this vulnerability, developers should update their netmask package to version 2.0.1 or later. There is no known workaround for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for netmask →
FAQ
The netmask package is a Node.js module that provides functionality for working with IP addresses and subnets. It allows developers to manipulate and analyze IP addresses, calculate network masks, and perform various network-related operations.
This vulnerability allows attackers to bypass IP-based access control mechanisms. They can manipulate the netmask package by providing an IP address with an octal digit of 9, granting unauthorized access to systems or resources that rely on IP address filtering.
To fix this vulnerability, update your netmask package to version 2.0.1 or later. This version includes a complete fix for the issue.
There is no known workaround for this vulnerability. It is recommended to update the netmask package to the fixed version as soon as possible.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
Related vulnerabilities
Recent vulnerabilities recorded for netmask.
