{"id":99604,"date":"2021-03-29T10:22:51","date_gmt":"2021-03-29T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah"},"modified":"2021-03-29T10:22:51","modified_gmt":"2021-03-29T08:22:51","slug":"uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","title":{"rendered":"S\u00e4kerhetsbrist i NPM-paketet node-netmask, som anv\u00e4nds i 270 000 projekt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I NPM-paketet node-netmask, som har runt 3 miljoner nedladdningar per vecka och anv\u00e4nds som beroende av mer \u00e4n 270 000 projekt p\u00e5 GitHub, har en s\u00e5rbarhet (CVE-2021-28918) identifierats som g\u00f6r det m\u00f6jligt att kringg\u00e5 kontroller d\u00e4r n\u00e4tmasken anv\u00e4nds f\u00f6r att avg\u00f6ra om den ing\u00e5r i adresseringsintervall eller f\u00f6r filtrering. Problemet har \u00e5tg\u00e4rdats i versionen node-netmask 2.0.0. <\/p>\n

S\u00e5rbarheten g\u00f6r det m\u00f6jligt att behandla en extern IP-adress som en adress fr\u00e5n det interna n\u00e4tverket och vice versa, och med viss logik i anv\u00e4ndningen av modulen node-netmask i applikationen genomf\u00f6ra SSRF-attacker (Server-side request forgery), RFI (Remote File Inclusion) och LFI (Local File Inclusion) f\u00f6r att f\u00e5 \u00e5tkomst till resurser i det interna n\u00e4tverket och inkludera externa eller lokala filer i exekveringskedjan. Problemet ligger i att enlighet med specifikationen b\u00f6r str\u00e4ngv\u00e4rden av adresser som b\u00f6rjar med noll tolkas som oktala tal, men modulen \"node-netmask\" tar inte h\u00e4nsyn till denna egenskap och behandlar dem som decimaler. <\/p>\n

Till exempel kan en angripare beg\u00e4ra en lokal resurs genom att ange v\u00e4rdet \"0177.0.0.1\", vilket motsvarar \"127.0.0.1\", men modulen \"node-netmask\" kommer att ignorera nollan och behandla \"0177.0.0.1\" som \"177.0.0.1\", vilket i applikationen inte g\u00f6r det m\u00f6jligt att identifiera identiteten med \"127.0.0.1\" vid bed\u00f6mning av \u00e5tkomstregler. P\u00e5 samma s\u00e4tt kan angriparen ange adressen \"0127.0.0.1\", som borde vara identisk med \"87.0.0.1\", men i modulen \"node-netmask\" kommer den att behandlas som \"127.0.0.1\". Det g\u00e5r ocks\u00e5 att lura kontrollen av \u00e5tkomst till intran\u00e4tadresser genom att ange v\u00e4rden som \"012.0.0.1\" (motsvarande \"10.0.0.1\", men kommer vid kontroll att behandlas som 12.0.0.1). <\/p>\n

Forskarna som uppt\u00e4ckte problemet beskriver det som katastrofalt och ger flera angrepps-scenarier, men de flesta verkar vara hypotetiska. Till exempel n\u00e4mns m\u00f6jligheten att attackera en Node.js-applikation som g\u00f6r externa anslutningar f\u00f6r att beg\u00e4ra en resurs baserat p\u00e5 parametrar eller inkommande data, men ingen specifik applikation n\u00e4mns eller detaljeras. \u00c4ven om man skulle hitta applikationer som laddar resurser baserat p\u00e5 inmatade data IP-adresser<\/a>, det \u00e4r inte helt klart hur s\u00e5rbarheten kan till\u00e4mpas praktiskt utan anslutning till det lokala n\u00e4tverket eller utan att f\u00e5 kontroll \u00f6ver \"spegel\" -IP-adresser. <\/p>\n

Forskare spekulerar bara i att \u00e4garna av 87.0.0.1 (Telecom Italia) och 0177.0.0.1 (Brasil Telecom) har m\u00f6jlighet att kringg\u00e5 \u00e5tkomstbegr\u00e4nsningar till 127.0.0.1. Ett mer realistiskt scenario \u00e4r att anv\u00e4nda s\u00e5rbarheten f\u00f6r att kringg\u00e5 olika blockeringslistor som implementeras p\u00e5 applikationssidan. Problemet kan ocks\u00e5 till\u00e4mpas f\u00f6r att utbyta definitionen av intran\u00e4tomr\u00e5den i NPM-modulen \"private-ip.\"
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u0430\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u043b\u044f \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 node-netmask 2.0.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99604","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i NPM-paketet node-netmask, som anv\u00e4nds i 270 000 projekt | ProHoster","description":"I NPM-paketet node-netmask, som har ungef\u00e4r 3 miljoner nedladdningar i veckan och anv\u00e4nds som beroende av mer \u00e4n 270 000 projekt p\u00e5 GitHub, har en s\u00e5rbarhet (CVE-2021-28918) identifierats som m\u00f6jligg\u00f6r att kringg\u00e5 kontroller.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 270 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 node-netmask, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043e\u043a\u043e\u043b\u043e 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u0431\u043e\u043b\u0435\u0435 270 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-28918), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0432.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T08:22:51+00:00","article:modified_time":"2021-03-29T08:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 08:24:48","updated":"2026-02-08 20:40:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/99604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=99604"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/99604\/revisions"}],"predecessor-version":[{"id":158019,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/99604\/revisions\/158019"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=99604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=99604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=99604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}