Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-28918

Good to know:

icon
icon

Date: April 1, 2021

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Language: COFFEE_SCRIPT

Severity Score

Related Resources (19)

https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects
https://github.com/advisories/GHSA-pch5-whg9-qr2r
https://www.npmjs.com/package/netmask
https://github.com/rs/node-netmask
https://sick.codes/sick-2021-011
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
https://nvd.nist.gov/vuln/detail/CVE-2021-28918
https://nvd.nist.gov/vuln/detail/CVE-2021-29418
https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
https://github.com/rs/node-netmask/blob/98294cb20695f2c6c36219a4fbcd4744fb8d0682/CHANGELOG.md#v110-mar-18-2021
https://security.netapp.com/advisory/ntap-20210604-0001
https://security.netapp.com/advisory/ntap-20210528-0010
https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918
https://vuln.ryotak.me/advisories/6
https://security.netapp.com/advisory/ntap-20210528-0010/
https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications
https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4
https://www.mend.io/vulnerability-database/CVE-2021-28918

Severity Score

Weakness Type (CWE)

Incorrect Type Conversion or Cast

CWE-704

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version netmask - 2.0.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us