CVE-2021-28918
At a glance
- Source
- NVD
- EPSS
- EPSS 15.04 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Weaknesses (CWE)
- CWE-704 — Incorrect Type Conversion or Cast
References
- https://www.npmjs.com/package/netmask
- https://github.com/rs/node-netmask
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://security.netapp.com/advisory/ntap-20210528-0010/
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-4c7m-wxvm-r7gc — Improper parsing of octal bytes in netmask
- GHSA-pch5-whg9-qr2r — netmask npm package mishandles octal input data
European references
- ENISA EUVD · EUVD-2021-0754
- GCVE · GCVE-0-2021-28918
CERT-FR advisories
- CERTFR-2025-AVI-0608 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-785 — Multiples vulnérabilités dans IBM Cognos Analytics · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*≤ 1.0.6
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |