CVE-2021-28918 Server-side request forgery in n/a
Attackers can bypass IP filters to perform SSRF, RFI, and LFI attacks, accessing internal network resources via the netmask npm package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28918?
CVE-2021-28918 is a critical server-side request forgery vulnerability in n/a, published on 1 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Weakness: CWE-704
Which versions are affected by CVE-2021-28918?
It affects 1 product.
Products include Netmask Project Netmask.
How do I fix CVE-2021-28918?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-28918 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-28918 exists.
Public exploit code: 1 Nuclei template.