Critical netmask networking bug impacts thousands of applications

guest · May 1, 2021

Critical netmask networking bug impacts thousands of applications
March 28, 2021
https://www.bleepingcomputer.com/ne...orking-bug-impacts-thousands-of-applications/

Popular npm library netmask has a critical networking vulnerability.

netmask is frequently used by hundreds of thousands of applications to parse IPv4 addresses and CIDR blocks or compare them.

The component gets over 3 million weekly downloads, and as of today, has scored over 238 million total downloads over its lifetime. Further, about 278,000 GitHub repositories depend on netmask.
Click to expand...

Today, security researchers Victor Viale, Sick Codes, Nick Sahler, Kelly Kaoudis, and John Jackson have disclosed a flaw in the popular netmask library.

The vulnerability, tracked as CVE-2021-28918 and more recently as CVE-2021-29418, concerns how netmask handles mixed-format IP addresses, or more specifically when a decimal IPv4 address contains a leading zero.
Click to expand...

According to IETF's original specification, parts of an IPv4 address can be interpreted as octal if prefixed with a "0."

"But netmask ignores this. It will always consider parts as being decimal, which means that if you try and validate that an IP belongs in a range, it will be wrong for octal-based representations of IPv4 addresses," Sahler and Viale told BleepingComputer in an email interview.
Click to expand...

guest · May 1, 2021

Python also impacted by critical IP address validation vulnerability
May 1, 2021
https://www.bleepingcomputer.com/ne...critical-ip-address-validation-vulnerability/

The Python standard library ipaddress also suffers from the critical IP address validation vulnerability identical to the flaw that was reported in the "netmask" library earlier this year.

The researchers who had discovered the critical flaw in netmask, also discovered the same flaw in this Python module and have procured a vulnerability identifier: CVE-2021-29921.
Click to expand...

In March, BleepingComputer had first reported on a critical IP validation vulnerability in the netmask library used by thousands of applications.

The vulnerability, tracked by CVE-2021-28918, CVE-2021-29418, and CVE-2021-29424 existed in both npm and Perl versions of netmask, and some other similar libraries.
It turns out, the ipaddress standard library introduced in Python 3.3 is also impacted by this vulnerability, as disclosed by multiple researchers* this week.
Click to expand...

A proof-of-concept test by researchers Sick Codes and Victor Viale shows Python's ipaddress library would simply discard any leading zeroes.
In other words, when parsed by Python's ipaddress module, '010.8.8.8' would be treated as '10.8.8.8', instead of '8.8.8.8'.

"Improper input validation of octal strings in Python 3.8.0 thru v3.10 stdlib ipaddress allows unauthenticated remote attackers to perform indeterminate [Server-Side Request Forgery (SSRF), Remote File Inclusion (RFI), and Local File Inclusion (LFI) attacks] on many programs that rely on Python stdlib ipaddress," state the researchers.
Click to expand...

guest · Aug 7, 2021

Go, Rust "net" library affected by critical IP address validation vulnerability
August 7, 2021
https://www.bleepingcomputer.com/ne...critical-ip-address-validation-vulnerability/

The commonly used "net" library in Go and Rust languages is also impacted by the mixed-format IP address validation vulnerability.

The bug has to do with how net treats IP addresses as decimal, even when they are provided in a mixed (octal-decimal) format.
Consequently, applications relying on net could be vulnerable to indeterminate Server-Side Request Forgery (SSRF) and Remote File Inclusion (RFI) vulnerabilities.
Click to expand...

Leading zero changes the IP address
This week, at DEF CON, security researchers Cheng Xu, Victor Viale, Sick Codes, Nick Sahler, Kelly Kaoudis, opennota, and John Jackson have disclosed a flaw in the net module of Go and Rust languages.

The vulnerability, tracked by CVE-2021-29922 (for Rust) and CVE-2021-29923 (for Golang) concerns how net handles mixed-format IP addresses, or more specifically when a decimal IPv4 address contains a leading zero.
A simple search for "import net" on GitHub reveals over 4 million files for Go alone relying on the net library.
Click to expand...

According to the project maintainers, Golang's net module would have a patch [1, 2] issued in (beta) version 1.17.

For Rust, a fix has already been merged in the net library, as confirmed by BleepingComputer:
Rust language users should be using version 1.53.0 or above that contains the mitigations for this vulnerability.
Click to expand...

Log in or Sign up

Critical netmask networking bug impacts thousands of applications

guest Guest

guest Guest

guest Guest

Log in or Sign up

Critical netmask networking bug impacts thousands of applications

guest Guest

guest Guest

guest Guest

Useful Searches