Server-side Request Forgery (SSRF) Affecting org.webjars.npm:netmask package, versions [,2.0.2)

org.webjars.npm:netmask is a library to parse IPv4 CIDR blocks.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). It incorrectly evaluates individual IPv4 octets that contain octal strings as left-stripped integers, leading to an inordinate attack surface on hundreds of thousands of projects that rely on netmask to filter or evaluate IPv4 block ranges, both inbound and outbound.

For example, a remote unauthenticated attacker can request local resources using input data 0177.0.0.1 (127.0.0.1), which netmask evaluates as the public IP 177.0.0.1. Contrastingly, a remote authenticated or unauthenticated attacker can input the data 0127.0.0.01 (87.0.0.1) as localhost, yet the input data is a public IP and can potentially cause local and remote file inclusion (LFI/RFI). A remote authenticated or unauthenticated attacker can bypass packages that rely on netmask to filter IP address blocks to reach intranets, VPNs, containers, adjacent VPC instances, or LAN hosts, using input data such as 012.0.0.1 (10.0.0.1), which netmask evaluates as 12.0.0.1 (public).

NOTE: This vulnerability has also been identified as: CVE-2021-29418

• GitHub Commit
• PoC
• Researcher Report
• Nuclei Templates