Nuglaanta la xidhiidha habaynta khaldan ee ciwaanada IP-ga ee leh nambarka octal ee shaqooyinka falanqaynta ciwaanka ayaa lagu aqoonsaday maktabadaha caadiga ah ee luqadaha Rust iyo Go. Nuglaanta ayaa suurtogal ka dhigaysa in laga gudbo hubinta ciwaannada saxda ah ee codsiyada, tusaale ahaan, in la abaabulo gelitaanka ciwaannada loopback interface (127.xxx) ama shabakadaha intranet-ka marka la fulinayo weerarada SSRF (Server-side request forgery). Nuglaanta waxay sii wadaa wareegga dhibaatooyinka horay loogu aqoonsaday maktabadaha node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE- 2021-29921), Xog :: Xaqiiji :: IP (Perl, CVE-2021-29662) iyo Net :: Netmask (Perl, CVE-2021-29424).
Marka loo eego qeexitaanka, qiyamka xargaha IP-ga ee ka bilaabmaya eber waa in loo tarjumaa lambarrada octal, laakiin maktabado badan ayaan xisaabtan tan ku xisaabtamin oo si fudud u tuurin eber, iyagoo qiimeeya sida tiro tobanle ah. Tusaale ahaan, lambarka 0177 ee octal wuxuu la mid yahay 127 jajab tobanle. Weeraryahanku wuxuu codsan karaa kheyraad isagoo qeexaya qiimaha "0177.0.0.1", kaas oo marka la eego jajab tobanle u dhigma "127.0.0.1". Haddii maktabadda dhibaatada leh la isticmaalo, codsigu ma ogaan doono in ciwaanka 0177.0.0.1 uu ku jiro subnet-ka 127.0.0.1/8, laakiin dhab ahaantii, marka la dirayo codsi, waxay geli kartaa ciwaanka "0177.0.0.1", kaas oo Hawlaha shabakadu waxay u shaqayn doonaan sida 127.0.0.1. Si la mid ah, waxaad khiyaami kartaa jeegga gelitaanka ciwaannada intranetka adiga oo qeexaya qiyamka sida "012.0.0.1" (oo u dhiganta "10.0.0.1").
Rust gudaheeda, maktabadda caadiga ah "std :: net" waxaa saameeyay arrin (CVE-2021-29922). Baadhitaanka ciwaanka IP-ga ee maktabaddan waxa uu tuuray eber ka hor qiyamka ciwaanka, laakiin kaliya haddii aan ka badnayn saddex lambar oo la cayimay, tusaale ahaan, "0177.0.0.1" waxaa loo arki doonaa qiimo aan sax ahayn, iyo natiijo khaldan. waxaa lagu soo celin doonaa jawaabta 010.8.8.8 iyo 127.0.026.1. Codsiyada isticmaala std ::net :: IPAddr marka la falanqeynayo ciwaanada gaarka ah isticmaaluhu waxay u nuglaadaan SSRF (codsiga dhinaca adeegatada ah), RFI (Ku darida Faylka Fog) iyo LFI (Ku darida Faylka Maxaliga ah). Nuglaanta waxaa lagu hagaajiyay laanta Rust 1.53.0.
Go, maktabadda caadiga ah "net" waa la saameeyaa (CVE-2021-29923). Shabakadda net.ParseCIDR ee ku dhex dhisan waxay ka boodaa eber hortii tirooyinka octal halkii ay ka farsamayn lahaayeen. Tusaale ahaan, weeraryahanku wuxuu dhaafi karaa qiimaha 00000177.0.0.1, kaas oo, marka la hubiyo net.ParseCIDR (00000177.0.0.1/24) shaqada, waxaa loo kala saari doonaa sida 177.0.0.1/24, oo aan ahayn 127.0.0.1/24. Dhibaatadu waxay sidoo kale ka muuqataa goobta Kubernetes. Nuglaanta waxay ku go'an tahay siidaynta Go 1.16.3 iyo beta 1.17.
Source: opennet.ru