{"id":99604,"date":"2021-03-29T10:22:51","date_gmt":"2021-03-29T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah"},"modified":"2021-03-29T10:22:51","modified_gmt":"2021-03-29T08:22:51","slug":"uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","title":{"rendered":"Vulnerability in the NPM package node-netmask, used in 270 thousand projects","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W paczce NPM node-netmask, kt\u00f3ra ma oko\u0142o 3 miliony pobra\u0144 tygodniowo i jest u\u017cywana jako zale\u017cno\u015b\u0107 w ponad 270 tysi\u0105cach projekt\u00f3w na GitHubie, wykryto luk\u0119 (CVE-2021-28918), umo\u017cliwiaj\u0105c\u0105 omini\u0119cie weryfikacji, w kt\u00f3rych maska sieciowa jest u\u017cywana do okre\u015blenia nale\u017cno\u015bci do zakres\u00f3w adres\u00f3w lub do filtrowania. Problem zosta\u0142 rozwi\u0105zany w wydaniu node-netmask 2.0.0. <\/p>\n

Luka pozwala na traktowanie zewn\u0119trznego adresu IP jako adresu z wewn\u0119trznej sieci i odwrotnie, a przy okre\u015blonej logice u\u017cycia modu\u0142u node-netmask w aplikacji na wykonanie atak\u00f3w SSRF (Server-side request forgery), RFI (Remote File Inclusion) i LFI (Local File Inclusion) w celu uzyskania dost\u0119pu do zasob\u00f3w wewn\u0119trznej sieci i w\u0142\u0105czenia w \u0142a\u0144cuch wykonywania zewn\u0119trznych lub lokalnych plik\u00f3w. Problem polega na tym, \u017ce zgodnie ze specyfikacj\u0105 warto\u015bci adres\u00f3w zaczynaj\u0105cych si\u0119 od zera musz\u0105 by\u0107 interpretowane jako liczby \u00f3semkowe, jednak modu\u0142 \u201enode-netmask\u201d nie uwzgl\u0119dnia tej cechy i traktuje je jako liczby dziesi\u0119tne. <\/p>\n

Na przyk\u0142ad atakuj\u0105cy mo\u017ce \u017c\u0105da\u0107 lokalnego zasobu, wskazuj\u0105c warto\u015b\u0107 \u201e0177.0.0.1\u201d, kt\u00f3ra odpowiada \u201e127.0.0.1\u201d, ale modu\u0142 \u201enode-netmask\u201d odrzuci zero i potraktuje \u201e0177.0.0.1\u201d jako \u201e177.0.0.1\u201d, co w aplikacji przy ocenie regu\u0142 dost\u0119pu nie umo\u017cliwi okre\u015blenia to\u017csamo\u015bci z \u201e127.0.0.1\u201d. Podobnie atakuj\u0105cy mo\u017ce wskaza\u0107 adres \u201e0127.0.0.1\u201d, kt\u00f3ry powinien by\u0107 to\u017csamy z \u201e87.0.0.1\u201d, ale w module \u201enode-netmask\u201d b\u0119dzie traktowany jako \u201e127.0.0.1\u201d. W podobny spos\u00f3b mo\u017cna oszuka\u0107 weryfikacj\u0119 dost\u0119pu do adres\u00f3w intranetowych, wskazuj\u0105c warto\u015bci takie jak \u201e012.0.0.1\u201d (odpowiednik \u201e10.0.0.1\u201d, ale podczas weryfikacji b\u0119dzie traktowany jako 12.0.0.1). <\/p>\n

Badacze, kt\u00f3rzy wykryli problem, nazywaj\u0105 go katastrofalnym i przedstawiaj\u0105 kilka scenariuszy atak\u00f3w, ale wi\u0119kszo\u015b\u0107 z nich wydaje si\u0119 by\u0107 tylko teoretyczna. Na przyk\u0142ad m\u00f3wi si\u0119 o mo\u017cliwo\u015bci atakowania aplikacji opartej na Node.js, kt\u00f3ra nawi\u0105zuje zewn\u0119trzne po\u0142\u0105czenia w celu \u017c\u0105dania zasobu na podstawie parametr\u00f3w lub danych wej\u015bciowych, ale konkretna aplikacja nie jest wymieniana ani szczeg\u00f3\u0142owo opisywana. Nawet je\u015bli uda si\u0119 znale\u017a\u0107 aplikacje, kt\u00f3re pobieraj\u0105 zasoby na podstawie wprowadzonych adres\u00f3w IP<\/a>, nie do ko\u0144ca jasne, jak mo\u017cna zastosowa\u0107 t\u0119 luk\u0119 w praktyce bez pod\u0142\u0105czenia do lokalnej sieci lub bez uzyskania kontroli nad «lustrowymi» adresami IP. <\/p>\n

Badacze jedynie sugeruj\u0105, \u017ce w\u0142a\u015bciciele 87.0.0.1 (Telecom Italia) i 0177.0.0.1 (Brasil Telecom) maj\u0105 mo\u017cliwo\u015b\u0107 obej\u015bcia ogranicze\u0144 dost\u0119pu do 127.0.0.1. Bardziej realistycznym scenariuszem jest wykorzystanie tej luki do omini\u0119cia r\u00f3\u017cnych list blokuj\u0105cych, wdro\u017conych po stronie aplikacji. Problem ten mo\u017ce by\u0107 r\u00f3wnie\u017c stosowany do wymiany definicji zakres\u00f3w intranetowych w module NPM «private-ip».
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u0430\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 node-netmask 2.0.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99604","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w pakiecie NPM node-netmask, stosowanym w 270 tys. projekt\u00f3w | ProHoster","description":"W pakiecie NPM node-netmask, kt\u00f3ry ma oko\u0142o 3 miliony pobra\u0144 tygodniowo i jest u\u017cywany jako zale\u017cno\u015b\u0107 w ponad 270 tysi\u0105cach projekt\u00f3w na GitHubie, wykryto luk\u0119 (CVE-2021-28918), kt\u00f3ra umo\u017cliwia obej\u015bcie kontroli.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 270 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T08:22:51+00:00","article:modified_time":"2021-03-29T08:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 08:24:48","updated":"2026-02-08 20:40:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=99604"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99604\/revisions"}],"predecessor-version":[{"id":158019,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99604\/revisions\/158019"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=99604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=99604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=99604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}