{"id":99604,"date":"2021-03-29T10:22:51","date_gmt":"2021-03-29T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah"},"modified":"2021-03-29T10:22:51","modified_gmt":"2021-03-29T08:22:51","slug":"uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","title":{"rendered":"Turvaauk NPM-pakendis node-netmask, mida kasutatakse 270 000 projektis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

NPM-pakettis node-netmask, millel on n\u00e4dalas umbes 3 miljonit allalaadimist ja mida kasutatakse enam kui 270 000 projekti s\u00f5ltuvusena GitHubis, leiti haavatavus (CVE-2021-28918), mis v\u00f5imaldab m\u00f6\u00f6da minna kontrollidest, kus v\u00f5rgumaskit kasutatakse aadresside vahemike m\u00e4\u00e4ramiseks v\u00f5i filtreerimiseks. Probleem on lahendatud node-netmask versioonis 2.0.0. <\/p>\n

Haavatavus v\u00f5imaldab t\u00f6\u00f6tlemisel v\u00e4lise IP-aadressi k\u00e4sitlemist sisemise v\u00f5rguna ja vastupidi. Teatud loogika korral node-netmask mooduli kasutamisel rakenduses on v\u00f5imalik teostada SSRF (Server-side request forgery), RFI (Remote File Inclusion) ja LFI (Local File Inclusion) r\u00fcnnakuid, mis v\u00f5imaldab p\u00f6\u00f6rduda sisemise v\u00f5rgu ressursside poole ning lisada v\u00e4liseid v\u00f5i kohalikke faile t\u00e4itmisprotsessi. Probleem seisneb selles, et vastavalt spetsifikatsioonile peavad nullist algavad stringilised aadressiv\u00e4\u00e4rtused olema t\u00f5lgendatud kui kaheksandelised numbrid, kuid moodul «node-netmask» ei arvestanud seda erip\u00e4ra ning t\u00f6\u00f6tab neid k\u00fcmnendsete numbritena. <\/p>\n

N\u00e4iteks v\u00f5ib r\u00fcndaja k\u00fcsida kohalikku ressurssi, esitades v\u00e4\u00e4rtuse «0177.0.0.1», mis vastab «127.0.0.1»-le, kuid «node-netmask» moodul j\u00e4tab nulli k\u00f5rvale ja k\u00e4sitleb «0177.0.0.1″ kui «177.0.0.1», mist\u00f5ttu ei ole rakenduses juurdep\u00e4\u00e4sureeglite hindamisel v\u00f5imalik tuvastada, et see on sama mis «127.0.0.1». Sarnaselt v\u00f5ib r\u00fcndaja esitada aadressi «0127.0.0.1», mis peaks olema sama kui «87.0.0.1», kuid «node-netmask» moodul k\u00e4sitleb seda nagu «127.0.0.1». Samuti v\u00f5ib petta sisev\u00f5rgu aadresside kontrollimist, esitades v\u00e4\u00e4rtusi nagu «012.0.0.1» (ekvivalent «10.0.0.1», kuid kontrollimisel t\u00f6\u00f6deldakse seda kui 12.0.0.1). <\/p>\n

Probleemi tuvastanud teadlased nimetavad seda katastroofiliseks ja toovad v\u00e4lja mitmeid r\u00fcnnaku stsenaariume, kuid enamik neist tundub olema teoreetilised. N\u00e4iteks r\u00e4\u00e4gitakse v\u00f5imalusest r\u00fcnnata Node.js rakendust, mis loob v\u00e4liseid \u00fchendusi, et k\u00fcsida ressursse s\u00f5ltuvalt parameetritest v\u00f5i sisendandmetest, kuid konkreetset rakendust ei nimetata ega detailiseerita. Isegi kui leida rakendusi, mis laadivad ressursse sisestatud andmete p\u00f5hjal. IP-aadresse<\/a>, ei ole p\u00e4ris selge, kuidas saab haavatavust praktikas rakendada ilma, et oleks \u00fchendatud kohalikku v\u00f5rku v\u00f5i ilma, et saaks kontrolli all «peegel» IP-aadresse. <\/p>\n

Uurijad oletavad vaid, et IP-aadresside 87.0.0.1 (Telecom Italia) ja 0177.0.0.1 (Brasil Telecom) omanikud v\u00f5ivad taastada ligip\u00e4\u00e4su 127.0.0.1. K\u00e4egakatsutavam stsenaarium on haavatavuse kasutamine, et m\u00f6\u00f6da hiilida erinevatest blokeerimisnimekirjadest, mida rakenduse poolel on rakendatud. Probleem v\u00f5ib samuti puudutada intraneti aadresside vahetamist NPM-moodulis «private-ip».
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u0430\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 node-netmask 2.0.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99604","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus NPM-paketis node-netmask, mida kasutatakse 270 000 projektis | ProHoster","description":"NPM-paketis node-netmask, mis registreerib ligikaudu 3 miljonit allalaadimist n\u00e4dalas ja mida kasutatakse s\u00f5ltuvusena enam kui 270 000 projektis GitHubis, avastati haavatavus (CVE-2021-28918), mis v\u00f5imaldab \u00fcletada kontrollid, kus v\u00f5rgu maski kasutatakse aadresside vahemike m\u00e4\u00e4ratlemiseks v\u00f5i filtreerimiseks. Probleem on lahendatud node-netmask 2.0.0 v\u00e4ljaandes. Haavatavus v\u00f5imaldab v\u00e4lise IP-aadressi t\u00f6\u00f6tlemist kui","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 270 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u0430\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 node-netmask 2.0.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u0430\u043a","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T08:22:51+00:00","article:modified_time":"2021-03-29T08:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 08:24:48","updated":"2026-02-08 20:40:14"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=99604"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99604\/revisions"}],"predecessor-version":[{"id":158019,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/99604\/revisions\/158019"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=99604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=99604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=99604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}