A vulnerability has been identified in the NPM package node-netmask, which has around 3 million downloads per week and is used as a dependency in over 270,000 projects on GitHub (CVE-2021-28918), allowing bypassing checks where the network mask is used to determine membership in address ranges or for filtering. The issue has been resolved in the node-netmask 2.0.0 release.
The vulnerability allows external IP addresses to be treated as addresses from the internal network and vice versa. Given certain logic in the usage of the node-netmask module in an application, it can lead to SSRF (Server-side request forgery), RFI (Remote File Inclusion), and LFI (Local File Inclusion) attacks to access resources in the internal network and include external or local files in execution chains. The problem lies in the fact that, according to specification, string values of addresses starting with zero should be interpreted as octal numbers, but the node-netmask module does not consider this nuance and processes them as decimal numbers.
For example, an attacker could request a local resource by specifying the value "0177.0.0.1", which corresponds to "127.0.0.1", but the node-netmask module will discard the leading zero and process 0177.0.0.1 as "177.0.0.1", which in the application will not allow identifying it as equal to "127.0.0.1" when evaluating access rules. Similarly, the attacker may specify the address "0127.0.0.1", which should be equal to "87.0.0.1", but in the node-netmask module will be processed as "127.0.0.1". Likewise, the check for intranet addresses can be deceived by specifying values like "012.0.0.1" (equivalent to "10.0.0.1", but will be processed as 12.0.0.1 during the check).
Researchers who discovered the issue describe it as catastrophic and provide several attack scenarios, though most of them seem theoretical. For example, it is mentioned that there is a possibility to attack applications based on Node.js that establish external connections to request resources based on parameters or incoming request data, but no specific application is named or detailed. Even if applications performing resource loading based on input are found. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community., it is not entirely clear how to exploit the vulnerability in practice without connecting to a local network or gaining control of the "mirror" IP addresses.
Researchers only suggest that the owners of 87.0.0.1 (Telecom Italia) and 0177.0.0.1 (Brasil Telecom) may have the ability to bypass access restrictions to 127.0.0.1. A more realistic scenario would involve using the vulnerability to circumvent various blocklists implemented on the application side. The issue could also be applied to exchange definitions of intranet ranges in the NPM module "private-ip."
Source: opennet.ru
