Vulnerability · Published Apr 1, 2021 · Assigned by mitre
CVE-2021-28918
Critical 9.1
In plain English
A critical-severity security flaw in the netmask package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.0% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)15.0%top 3.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | netmask | 1.1.0 | GHSA-4c7m-wxvm-r7gc |
| npm | netmask | 2.0.1 | GHSA-pch5-whg9-qr2r |
Affected products (as reported)
References
- https://www.npmjs.com/package/netmask x_refsource_MISC
- https://github.com/rs/node-netmask x_refsource_MISC
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ x_refsource_MISC
- https://github.com/advisories/GHSA-pch5-whg9-qr2r x_refsource_MISC
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210528-0010/ x_refsource_CONFIRM
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/ x_refsource_MISC