CVE-2021-33318
📋 TL;DR
This vulnerability allows attackers to bypass IP address filtering in applications using vulnerable versions of WatsonWebserver or IpMatcher packages. Attackers can craft malicious IP addresses or netmasks that are incorrectly validated, potentially gaining unauthorized access. Any .NET application using these packages for IP-based access control is affected.
💻 Affected Systems
- WatsonWebserver
- IpMatcher
📦 What is this software?
Ipmatcher by Ipmatcher Project
Watsonwebserver by Watsonwebserver Project
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass leading to unauthorized access to protected resources, potential data exposure, or remote code execution if combined with other vulnerabilities.
Likely Case
Bypass of IP-based access controls allowing unauthorized access to web applications or APIs that rely on these packages for IP filtering.
If Mitigated
Limited impact if additional authentication layers exist beyond IP filtering, though IP-based security controls would be compromised.
🎯 Exploit Status
Exploitation requires sending specially crafted IP addresses or netmasks to bypass validation logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IpMatcher 1.0.4.2+, WatsonWebserver 4.1.4+
Vendor Advisory: https://github.com/jchristn/IpMatcher/commit/81d77c2f33aa912dbd032b34b9e184fc6e041d89
Restart Required: Yes
Instructions:
1. Update NuGet packages to IpMatcher >=1.0.4.2 or WatsonWebserver >=4.1.4. 2. Rebuild and redeploy applications. 3. Restart affected services.
🔧 Temporary Workarounds
Implement additional IP validation layer
allAdd custom IP address validation before passing to vulnerable packages
Use network-level filtering
allImplement firewall rules or network ACLs instead of application-level IP filtering
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious IP patterns
- Add additional authentication layers beyond IP-based access control
🔍 How to Verify
Check if Vulnerable:
Check project dependencies for IpMatcher <=1.0.4.1 or WatsonWebserver <=4.1.3 in .csproj files or NuGet packages.Check Version:
dotnet list package | findstr /i "IpMatcher WatsonWebserver"Verify Fix Applied:
Verify updated packages show IpMatcher >=1.0.4.2 or WatsonWebserver >=4.1.4 in dependencies.📡 Detection & Monitoring
Log Indicators:
- Unusual IP addresses in access logs
- Requests from unexpected IP ranges bypassing filters
Network Indicators:
- Traffic from IP addresses that should be blocked by application logic
SIEM Query:
source_ip NOT IN allowed_ips AND action="allowed" WHERE application="affected_app"🔗 References
- https://github.com/jchristn/IpMatcher
- https://github.com/jchristn/IpMatcher/commit/81d77c2f33aa912dbd032b34b9e184fc6e041d89
- https://github.com/jchristn/WatsonWebserver
- https://github.com/kaoudis/advisories/blob/main/0-2021.md
- https://github.com/jchristn/IpMatcher
- https://github.com/jchristn/IpMatcher/commit/81d77c2f33aa912dbd032b34b9e184fc6e041d89
- https://github.com/jchristn/WatsonWebserver
- https://github.com/kaoudis/advisories/blob/main/0-2021.md
