A node-netmask NPM package, which has about 3 million downloads per week and is used as a dependency by more than 270,000 projects on GitHub, has a vulnerability (CVE-2021-28918) that allows evasion of checks where the network mask is used to determine membership in address ranges or for filtering. The issue has been resolved in node-netmask release 2.0.0.
The vulnerability allows external IP addresses to be processed as addresses from the internal network and vice versa, and under certain logic for using the node-netmask module in an application, it can facilitate SSRF (Server-side request forgery), RFI (Remote File Inclusion), and LFI (Local File Inclusion) attacks to access resources on the internal network and include external or local files in the execution chain. The issue stems from the fact that according to the specification, string values of addresses starting with zero should be interpreted as octal numbers, but the 'node-netmask' module does not account for this peculiarity and processes them as decimal numbers.
For example, an attacker can request a local resource by specifying the value '0177.0.0.1', which corresponds to '127.0.0.1', but the 'node-netmask' module will discard the zero and process '0177.0.0.1' as '177.0.0.1', which in the application will not allow for identity matching with '127.0.0.1' during access rule evaluation. Similarly, an attacker can specify the address '0127.0.0.1', which should be identical to '87.0.0.1', but in the 'node-netmask' module will be processed as '127.0.0.1'. Likewise, checks against intranet addresses can be deceived by specifying values such as '012.0.0.1' (equivalent to '10.0.0.1', but will be processed as '12.0.0.1' during validation).
Researchers who identified the problem describe the issue as catastrophic and provide several attack scenarios, but most seem speculative. For instance, there is mention of the possibility of attacking a Node.js-based application that establishes external connections to request resources based on parameters or request input data, but the specific application is not named or detailed. Even if applications that load resources based on input entered are found, IP-címekit is not entirely clear how the vulnerability could be practically exploited without connecting to a local network or gaining control of 'mirror' IP addresses.
A kutatók csak feltételezik, hogy a 87.0.0.1 (Telecom Italia) és a 0177.0.0.1 (Brasil Telecom) tulajdonosai képesek megkerülni a 127.0.0.1-hez való hozzáférés korlátozását. A valószínűbb forgatókönyv a sebezhetőség kihasználása különböző blokkolási listák megkerülésére, amelyek az alkalmazás oldalán vannak megvalósítva. A probléma egyben a NPM csomag „private-ip” intranet tartományainak lekérdezésére is vonatkozhat.
Forrás: opennet.ru
