Vulnerability CVE-2021-28918
Published: 2021-04-01

Description:
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Netmask project -> Netmask 

 References:
https://github.com/advisories/GHSA-pch5-whg9-qr2r
https://github.com/rs/node-netmask
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
https://www.npmjs.com/package/netmask
Copyright 2024, cxsecurity.com

 

Back to Top