Vulnerabilities related to the incorrect handling of IP addresses containing octal digits have been identified in the standard libraries of Rust and Go in address parsing functions. These vulnerabilities allow bypassing valid address checks in applications, for instance, enabling access to loopback interface addresses (127.x.x.x) or intranet subnets during SSRF (Server-side request forgery) attacks. These vulnerabilities continue a cycle of issues previously identified in libraries like node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE-2021-29921), Data::Validate::IP (Perl, CVE-2021-29662), and Net::Netmask (Perl, CVE-2021-29424).
According to the specification, string values (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community., starting with zero, should be interpreted as octal numbers, but many libraries do not consider this characteristic and simply discard the leading zero, treating the value as a decimal number. For example, the number 0177 in octal equals 127 in decimal. An attacker can request a resource by specifying the value '0177.0.0.1', which corresponds to '127.0.0.1' in decimal. When using a problematic library, the application will not recognize the address 0177.0.0.1 as being part of the subnet 127.0.0.1/8, but it may actually send a request to '0177.0.0.1', which network functions will process as 127.0.0.1. Similarly, intranet address checks can be deceived by specifying values like '012.0.0.1' (equivalent to '10.0.0.1').
In Rust, the issue affected the standard library 'std::net' (CVE-2021-29922). The IP address parser in this library discarded the leading zero for address values but only if there were no more than three digits specified; for example, '0177.0.0.1' would be treated as an invalid value, while the responses to 010.8.8.8 and 127.0.026.1 would yield incorrect results. Applications using std::net::IpAddr when parsing user-specified addresses are potentially vulnerable to SSRF (Server-side request forgery), RFI (Remote File Inclusion), and LFI (Local File Inclusion) attacks. The vulnerability has been fixed in the Rust 1.53.0 branch.
In the Go language, the standard library "net" is vulnerable (CVE-2021-29923). The built-in function net.ParseCIDR improperly handles leading zeros before octet numbers instead of processing them. For example, an attacker could pass the value 00000177.0.0.1, which when checked in the function net.ParseCIDR(00000177.0.0.1/24) will be parsed as 177.0.0.1/24, not 127.0.0.1/24. This issue is also present in the Kubernetes platform. The vulnerability has been fixed in Go release 1.16.3 and the beta version 1.17.
Source: opennet.ru
