CVE-2021-28918
📋 TL;DR
A vulnerability in the netmask npm package allows attackers to bypass IP address filtering by submitting specially crafted octal strings. This enables Server-Side Request Forgery (SSRF), Remote File Inclusion (RFI), and Local File Inclusion (LFI) attacks against systems using vulnerable versions. Over 280,000 projects depending on netmask are potentially affected.
💻 Affected Systems
- netmask npm package
- Any application/package depending on netmask v1.0.6 or earlier
📦 What is this software?
Netmask by Netmask Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers bypass network segmentation to access internal VPN/LAN resources, execute arbitrary code on backend systems, or read sensitive files from the server.
Likely Case
SSRF attacks allowing access to internal services, cloud metadata endpoints, or file disclosure from vulnerable applications.
If Mitigated
Limited to applications with additional input validation layers or those not using netmask for security-critical filtering.
🎯 Exploit Status
Proof-of-concept code is publicly available, and exploitation requires minimal technical skill due to simple input manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: netmask v2.0.1
Vendor Advisory: https://github.com/advisories/GHSA-pch5-whg9-qr2r
Restart Required: No
Instructions:
1. Update package.json to require netmask ^2.0.1. 2. Run 'npm update netmask'. 3. Test application functionality with updated version.
🔧 Temporary Workarounds
Input validation wrapper
allImplement additional input validation before passing IP addresses to netmask functions
// JavaScript example: Validate IP format before netmask processing
function validateIP(input) {
// Add regex validation for proper IP format
const ipRegex = /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/;
return ipRegex.test(input);
}
🧯 If You Can't Patch
- Implement network-level controls to restrict outbound connections from vulnerable systems
- Deploy WAF rules to block requests containing octal notation in IP parameters
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for netmask version <=1.0.6, or run 'npm list netmask'Check Version:
npm list netmask | grep netmaskVerify Fix Applied:
Confirm netmask version is 2.0.1 or higher via 'npm list netmask'📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connections from application servers
- Requests containing IP addresses with leading zeros (octal notation)
Network Indicators:
- Traffic from web servers to internal IP ranges not normally accessed
- Unexpected connections to cloud metadata services
SIEM Query:
source="web_logs" AND (uri="*ip=0*" OR uri="*ip=0[0-7]*")🔗 References
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
- https://github.com/rs/node-netmask
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
- https://security.netapp.com/advisory/ntap-20210528-0010/
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
- https://www.npmjs.com/package/netmask
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
- https://github.com/rs/node-netmask
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
- https://security.netapp.com/advisory/ntap-20210528-0010/
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
- https://www.npmjs.com/package/netmask
