Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote malicious users to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
netmask project netmask |
Are you local? Catastrophically local? Trail of Bits security peeps emit tool to weaponize Python's insecure pickle files to hopefully now get everyone's attention
The widely used npm library netmask has a networking vulnerability arising from how it parses IP addresses with a leading zero, leaving an estimated 278,000 projects at risk. Researchers Victor Viale, Sick Codes, Kelly Kaoudis, John Jackson, and Nick Sahler have disclosed a digital nasty, tracked as CVE-2021-28918, in the hugely widespread netmask npm package. It's a handy bit of code used for parsing and comparing IP addresses, and the flaw lies in how it handles mixed-format IP addresses. Name...
Vulmon