Fix CVE–2021–28918

[debricked]

CVE–2021–28918

Vulnerability details

Description

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

GitHub

Improper parsing of octal bytes in netmask

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

❗ NOTE: The fix for this issue was incomplete. A subsequent fix was made in version 2.0.1 which was assigned CVE-2021-29418 / GHSA-pch5-whg9-qr2r. For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.

NVD

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

CVSS details - 9.1

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	None

References

    Improper parsing of octal bytes in netmask · CVE-2021-28918 · GitHub Advisory Database · GitHub
    NVD - CVE-2021-28918
    GitHub - rs/node-netmask: Parse and lookup IP network blocks
    security/SICK-2021-011.md at master · sickcodes/security · GitHub
    Critical netmask networking bug impacts thousands of applications
    netmask - npm
    CVE-2021-28918 Node.js Vulnerability in NetApp Products | NetApp Product Security
    netmask npm package vulnerable to octal input data · CVE-2021-29418 · GitHub Advisory Database · GitHub
    Vulnerability in ‘netmask’ npm Package Affects 280,000 Projects
    node-netmask/CHANGELOG.md at 98294cb20695f2c6c36219a4fbcd4744fb8d0682 · rs/node-netmask · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE