CVE-2021-28918: netmask - Improper Parsing of Octal Bytes in Netmask
Summary
CVE-2021-28918: Improper parsing of octal bytes in netmask. Affects netmask versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netmask package is an npm package used for IP address manipulation and filtering. It provides functionality to parse and validate IP addresses and netmasks. The package is widely used in various applications and libraries that rely on IP address filtering, such as firewalls, VPNs, and network security tools. However, versions 1.0.6 and below of the netmask package are vulnerable to an improper parsing of octal bytes in netmask strings.
Vulnerability Detail
The vulnerability in the netmask package allows unauthenticated remote attackers to perform indeterminate SSRF (Server-Side Request Forgery), RFI (Remote File Inclusion), and LFI (Local File Inclusion) attacks on many dependent packages. The issue arises due to improper input validation of octal strings in netmask. As a result, a remote unauthenticated attacker can bypass IP filtering mechanisms implemented by packages relying on netmask, potentially reaching critical VPN or LAN hosts. This vulnerability has a CVSS score of 9.1 (Critical).
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
npm install netmask@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the netmask package to mitigate the risk.
Conclusion
The netmask package versions 1.0.6 and below are vulnerable to an improper parsing of octal bytes in netmask strings. This vulnerability allows unauthenticated attackers to bypass IP filtering mechanisms and potentially reach critical VPN or LAN hosts. To mitigate the risk, it is crucial to upgrade to version 2.0.1 or later of the netmask package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for netmask →
FAQ
The vulnerability allows unauthenticated attackers to bypass IP filtering mechanisms and potentially reach critical VPN or LAN hosts.
Versions 1.0.6 and below of the netmask package are affected.
The CVSS score of this vulnerability is 9.1 (Critical).
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database and the CVE entry.
Related vulnerabilities
Recent vulnerabilities recorded for netmask.
