{"id":99604,"date":"2021-03-29T10:22:51","date_gmt":"2021-03-29T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah"},"modified":"2021-03-29T10:22:51","modified_gmt":"2021-03-29T08:22:51","slug":"uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","title":{"rendered":"Haavatavus NPM-paketis node-netmask, mida kasutatakse 270 000 projektis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

NPM pakettis node-netmask, millel on umbes 3 miljonit allalaadimist n\u00e4dalas ja mida kasutatakse s\u00f5ltuvusena rohkem kui 270 000 projektis GitHubis, tuvastati haavatavus (CVE-2021-28918), mis v\u00f5imaldab m\u00f6\u00f6da minna kontrollidest, milles v\u00f5rgu maski kasutatakse aadresside vahemike m\u00e4\u00e4ratlemiseks v\u00f5i filtreerimiseks. Probleem on k\u00f5rvaldatud versioonis node-netmask 2.0.0. <\/p>\n

Haavatavus v\u00f5imaldab v\u00e4lise IP-aadressi t\u00f6\u00f6tlemist kui sisev\u00f5rgu aadressi ja vastupidi, ning teatud mooduli node-netmask loogika abil rakenduses teostada SSRF (serveripoolne p\u00e4ringu vargus), RFI (kaugfaili kaasamine) ja LFI (kohalik faili kaasamine) r\u00fcnnakuid, et p\u00e4\u00e4seda ligi sisemistele ressurssidele ning h\u00f5lmata v\u00e4liseid v\u00f5i kohalikke faile t\u00e4itmise ahelas. Probleem on selles, et vastavalt spetsifikatsioonile peavad nulliga algavad aadresside stringilised v\u00e4\u00e4rtused olema t\u00f5lgendatud kui oktaalsed numbrid, kuid moodul \"node-netmask\" ei arvestanud seda omadust ja t\u00f6\u00f6tleb neid kui k\u00fcmnendnumbreid. <\/p>\n

N\u00e4iteks v\u00f5ib r\u00fcndaja k\u00fcsida kohalikku ressurssi, m\u00e4\u00e4rates v\u00e4\u00e4rtuseks \"0177.0.0.1\", mis vastab \"127.0.0.1\"-ile, kuid moodul \"node-netmask\" viskab nulli k\u00f5rvale ja t\u00f6\u00f6tleb \"0177.0.0.1\" kui \"177.0.0.1\", mis rakenduses juurdep\u00e4\u00e4sureeglite hindamisel ei v\u00f5imalda kindlaks teha, et tegemist on \"127.0.0.1\"-ga. Samamoodi v\u00f5ib r\u00fcndaja m\u00e4\u00e4rata aadressi \"0127.0.0.1\", mis peaks olema identne \"87.0.0.1\"-ga, kuid moodul \"node-netmask\" t\u00f6\u00f6tleb seda k\u00fclastavana \"127.0.0.1\". Samasugust meetodit saab kasutada intranetiaadresside kontrollimise petmiseks, m\u00e4\u00e4rates sellised v\u00e4\u00e4rtused nagu \"012.0.0.1\" (ekvivalent \"10.0.0.1\"-iga, kuid kontrollimise k\u00e4igus t\u00f6\u00f6deldakse seda kui \"12.0.0.1\"). <\/p>\n

Probleemi avastanud teadlased nimetavad probleemi katastroofiliseks ja toovad v\u00e4lja mitmeid r\u00fcnnakustsenaariume, kuid enamik neist tundub spekulatiivne. N\u00e4iteks r\u00e4\u00e4gitakse v\u00f5imalusest r\u00fcnnata Node.js-p\u00f5hist rakendust, mis loob v\u00e4liseid \u00fchendusi ressursi p\u00e4rimiseks parameetrite v\u00f5i sisendandmete p\u00f5hjal, kuid konkreetset rakendust ei nimetata ja ei detailita. Isegi kui leida rakendusi, mis teevad ressurside allalaadimist sisestatud andmete p\u00f5hjal, ei ole selge, kuidas haavatavust praktikas rakendada ilma kohaliku v\u00f5rgu \u00fchenduseta v\u00f5i ilma 'peegeldavate' IP-aadresse kontrollimata. IP-aadresse<\/a>, pole t\u00e4iesti selge, kuidas saab haavatavust praktikas kasutada ilma, et oleks \u00fchendatud kohaliku v\u00f5rgu v\u00f5i ilma \"peegeldavate\" IP-aadresside \u00fcle kontrolli saamiseta. <\/p>\n

Uurijad j\u00e4tavad vaid oletama, et aadresside omanikel 87.0.0.1 (Telecom Italia) ja 0177.0.0.1 (Brasil Telecom) v\u00f5ib olla v\u00f5imalus m\u00f6\u00f6da p\u00e4\u00e4seda juurdep\u00e4\u00e4supiirangutest 127.0.0.1. Realistlikum stsenaarium on haavatavuse kasutamine erinevate rakenduspoolselt rakendatud blokeerimisnimekirjade \u00fcletamiseks. Probleemi saab ka kasutada intraneti vahemike m\u00e4\u00e4ratlemise vahetamiseks NPM-moodulis \"private-ip\".
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u0430\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 node-netmask 2.0.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99604","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus NPM-paketis node-netmask, mida kasutatakse 270 000 projektis | ProHoster","description":"NPM-paketis node-netmask, millel on umbes 3 miljonit allalaadimist n\u00e4dalas ja mida kasutavad s\u00f5ltuvustena \u00fcle 270 000 projekti GitHubis, leiti haavatavus (CVE-2021-28918), mis v\u00f5imaldab l\u00e4bida kontrollid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 270 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T08:22:51+00:00","article:modified_time":"2021-03-29T08:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 08:24:48","updated":"2026-02-08 20:40:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=99604"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99604\/revisions"}],"predecessor-version":[{"id":158019,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99604\/revisions\/158019"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=99604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=99604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=99604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}