CVEvulnerability
CVE-2021-28918
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-04-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-704
Description
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Affected configurations
• netmask project netmask (<= 1.0.6)
Related
Weakness · CWE (1)
- CWE-704 Incorrect Type Conversion or Cast weakness
Referenced by CWE · observed example (1)
- CWE-1389 Incorrect Parsing of Numbers with Different Radices weakness
References
- https://github.com/advisories/GHSA-pch5-whg9-qr2r Third Party Advisory
- https://github.com/rs/node-netmask Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md Exploit, Third Party Advisory
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210528-0010/ Third Party Advisory
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ Exploit, Press/Media Coverage, Third Party Advisory
- https://www.npmjs.com/package/netmask Product, Third Party Advisory
- https://github.com/advisories/GHSA-pch5-whg9-qr2r Third Party Advisory
- https://github.com/rs/node-netmask Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md Exploit, Third Party Advisory
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210528-0010/ Third Party Advisory
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ Exploit, Press/Media Coverage, Third Party Advisory
- https://www.npmjs.com/package/netmask Product, Third Party Advisory