{"id":99604,"date":"2021-03-29T10:22:51","date_gmt":"2021-03-29T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah"},"modified":"2021-03-29T10:22:51","modified_gmt":"2021-03-29T08:22:51","slug":"uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","title":{"rendered":"Sebezhet\u0151s\u00e9g az NPM node-netmask csomagj\u00e1ban, amely 270 ezer projektben ker\u00fcl alkalmaz\u00e1sra","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A node-netmask NPM package, which has about 3 million downloads per week and is used as a dependency by more than 270,000 projects on GitHub, has a vulnerability (CVE-2021-28918) that allows evasion of checks where the network mask is used to determine membership in address ranges or for filtering. The issue has been resolved in node-netmask release 2.0.0. <\/p>\n

A sebezhet\u0151s\u00e9g lehet\u0151v\u00e9 teszi, hogy a k\u00fcls\u0151 IP-c\u00edmk\u00e9nt kezelj\u00fcnk egy bels\u0151 h\u00e1l\u00f3zati c\u00edmet \u00e9s ford\u00edtva, \u00e9s a node-netmask modul bizonyos logik\u00e1ja szerint SSRF (Server-side request forgery), RFI (Remote File Inclusion) \u00e9s LFI (Local File Inclusion) t\u00e1mad\u00e1sokat v\u00e9gezzen az alkalmaz\u00e1sban a bels\u0151 h\u00e1l\u00f3zat er\u0151forr\u00e1sainak el\u00e9r\u00e9s\u00e9re, valamint k\u00fcls\u0151 vagy helyi f\u00e1jlok futtat\u00e1si l\u00e1nc\u00e1ba t\u00f6rt\u00e9n\u0151 beilleszt\u00e9s\u00e9re. A probl\u00e9ma az, hogy a specifik\u00e1ci\u00f3 szerint a null\u00e1val kezd\u0151d\u0151 c\u00edmek sztring \u00e9rt\u00e9keit okt\u00e1lis sz\u00e1mk\u00e9nt kell \u00e9rtelmezni, azonban a node-netmask modul ezt a saj\u00e1toss\u00e1got figyelmen k\u00edv\u00fcl hagyja, \u00e9s t\u00edzes sz\u00e1mk\u00e9nt dolgozza fel \u0151ket. <\/p>\n

P\u00e9ld\u00e1ul a t\u00e1mad\u00f3 helyi er\u0151forr\u00e1st k\u00e9rhet a \u20180177.0.0.1\u2019 \u00e9rt\u00e9k megad\u00e1s\u00e1val, ami megfelel a \u2018127.0.0.1\u2019-nek, de a node-netmask modul elhagyja a null\u00e1t, \u00e9s a \u20180177.0.0.1\u2019-t \u2018177.0.0.1\u2019-k\u00e9nt kezeli, ami az alkalmaz\u00e1sban a hozz\u00e1f\u00e9r\u00e9si szab\u00e1lyok ki\u00e9rt\u00e9kel\u00e9se sor\u00e1n nem teszi lehet\u0151v\u00e9 a \u2018127.0.0.1\u2019-gel val\u00f3 azonoss\u00e1g meg\u00e1llap\u00edt\u00e1s\u00e1t. Hasonl\u00f3k\u00e9ppen a t\u00e1mad\u00f3 megadhatja az \u20180127.0.0.1\u2019 c\u00edmet, ami az \u201887.0.0.1\u2019-nek kellene lennie, de a node-netmask modul ezt \u2018127.0.0.1\u2019-k\u00e9nt fogja feldolgozni. Hasonl\u00f3k\u00e9ppen a bels\u0151 h\u00e1l\u00f3zati c\u00edmekhez val\u00f3 hozz\u00e1f\u00e9r\u00e9st is meg lehet csapni olyan \u00e9rt\u00e9kek megad\u00e1s\u00e1val, mint az \u2018012.0.0.1\u2019 (ez a \u201810.0.0.1\u2019-nek felel meg, de ellen\u0151rz\u00e9skor \u201812.0.0.1\u2019-k\u00e9nt lesz feldolgozva). <\/p>\n

Researchers who identified the problem describe the issue as catastrophic and provide several attack scenarios, but most seem speculative. For instance, there is mention of the possibility of attacking a Node.js-based application that establishes external connections to request resources based on parameters or request input data, but the specific application is not named or detailed. Even if applications that load resources based on input entered are found, IP-c\u00edmek<\/a>, nem teljesen vil\u00e1gos, hogyan lehetne a sebezhet\u0151s\u00e9get a gyakorlatban alkalmazni an\u00e9lk\u00fcl, hogy csatlakozn\u00e1nk a helyi h\u00e1l\u00f3zathoz vagy an\u00e9lk\u00fcl, hogy ellen\u0151rz\u00e9st szerezn\u00e9nk a \u2018t\u00fck\u00f6r\u2019 IP-c\u00edmek felett. <\/p>\n

A kutat\u00f3k csak felt\u00e9telezik, hogy a 87.0.0.1 (Telecom Italia) \u00e9s a 0177.0.0.1 (Brasil Telecom) c\u00edm\u0171 tulajdonosok k\u00e9pesek kiker\u00fclni a hozz\u00e1f\u00e9r\u00e9st a 127.0.0.1-hez. A realisztikusabb forgat\u00f3k\u00f6nyv a sebezhet\u0151s\u00e9g felhaszn\u00e1l\u00e1sa k\u00fcl\u00f6nb\u00f6z\u0151 jelsz\u00f3list\u00e1k megker\u00fcl\u00e9s\u00e9re, amelyeket az alkalmaz\u00e1s oldal\u00e1n val\u00f3s\u00edtottak meg. A probl\u00e9ma a NPM \u2018private-ip\u2019 modulj\u00e1ban az intranetes tartom\u00e1nyok meghat\u00e1roz\u00e1s\u00e1nak megoszt\u00e1s\u00e1ra is alkalmazhat\u00f3.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u0430\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 node-netmask 2.0.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99604","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9g a node-netmask NPM csomagban, amelyet 270 ezer projekt haszn\u00e1l | ProHoster","description":"A node-netmask NPM csomagban, amely k\u00f6r\u00fclbel\u00fcl 3 milli\u00f3 let\u00f6lt\u00e9st gener\u00e1l hetente \u00e9s t\u00f6bb mint 270 ezer projekt f\u00fcgg\u0151s\u00e9ge a GitHub-on, felfedeztek egy sebezhet\u0151s\u00e9get (CVE-2021-28918), amely lehet\u0151v\u00e9 teszi a ellen\u0151rz\u00e9sek megker\u00fcl\u00e9s\u00e9t.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 270 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T08:22:51+00:00","article:modified_time":"2021-03-29T08:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 08:24:48","updated":"2026-02-08 20:40:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/99604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=99604"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/99604\/revisions"}],"predecessor-version":[{"id":158019,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/99604\/revisions\/158019"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=99604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=99604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=99604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}