Netmask flaw allows hackers to bypass server access controls

The vulnerability could leave thousands of networks open to server-side request forgery

Security researchers have discovered a bug in the networking npm library netmask that enables hackers to bypass servers’ access controls and launch server-side request forgery attacks.

According to researchers at Sick Codes, hundreds of thousands of applications use the package to parse or compare IPv4 addresses and Classless Inter-Domain Routing (CIDR) blocks.

The problem is extensive because over 278,000 GitHub repositories use the code, which users downloaded over three million times last week alone. Researchers said the flaw has existed for over nine years.

The problem stems from the way netmask handles mixed-format IP addresses. When parsing an IP address with a leading zero, node-netmask sees a different IP address due to incorrect in-place validation.

An IP address can be represented in various formats, including hexadecimal and integer, although the most common IPv4 addresses are expressed in decimal format. 

For example, an IPv4 address represented in decimal format as 86.136.177.134 can be expressed in an octal format as 0126.0210.0261.0206. By prefixing the IPv4 address with a 0, pressing enter or returning will change the IP address to its decimal equivalent, 87.0.0.1, which is how most applications should handle such ambiguous IP addresses.

In the case of the netmask npm library, it’ll strip and discard any leading zeros. According to the original IETF specification, portions of an IPv4 address can be interpreted as octal if preceded by a "0" prefix.

The researchers warned that anyone could submit an address in netmask that looks like a private IP, but it connects to a public IP to download malicious files.

“If your browser recognizes octal literals, but a NodeJS application does not, users can submit all kinds of malevolent URLs that seem internal, but really go to remote files.

On the other hand, users can ALSO submit URLs that seem public, but they’re actually very private!” said researchers.

While the vulnerability seems insignificant, if an attacker can interfere with the IP address input analyzed by the application, the problem could lead to various other attacks, from Server-Side Request Forgery (SSRF) to remote access.

Related Resource

Remote workforce security report

Key challenges, security threats, and investment priorities of organisations during the pandemic

remote workforce security report - whitepaper from OktaDownload now

Researchers have reported the vulnerability to node-netmask developer Olivier Poitrey, who posted a series of fixes for the GitHub repository issue. Experts recommend netmask npm library users upgrade to version 2.0.0.

Ax Sharma, a security researcher at Sonatype, told ITPro that the vulnerability means hundreds of thousands of applications that rely on popular open source components, like this one, may not realize they could be potentially vulnerable to anti-Server-Side Request Forgery (SSRF) bypasses or remote file inclusion (RFI) should they be purely relying on netmask for parsing IP addresses, without adding their own proper input sanitization and normalization checks.

“This highlights the need for proper input hygiene and never trusting input no matter the source. In this case, for example, the fixes [1, 2] applied to netmask now take into account that IP addresses can also be provided in octal or hexadecimal formats, something users of netmask could also have implemented on their end as an extra precaution,” Sharma said.

Featured Resources

Next-generation time series: Forecasting for the real world, not the ideal world

Solve time series problems with AI

Free download

The future of productivity

Driving your business forward with Microsoft Office 365

Free download

How to plan for endpoint security against ever-evolving cyber threats

Safeguard your devices, data, and reputation

Free download

A quantitative comparison of UPS monitoring and servicing approaches across edge environments

Effective UPS fleet management

Free download

Recommended

BillQuick billing software exploit lets hackers deploy ransomware
Security

BillQuick billing software exploit lets hackers deploy ransomware

26 Oct 2021
Ransomware hit industrial sector the hardest in the third quarter
ransomware

Ransomware hit industrial sector the hardest in the third quarter

25 Oct 2021
Tesco services knocked offline after suspected cyber attack
hacking

Tesco services knocked offline after suspected cyber attack

25 Oct 2021
Microsoft touts new cyber security help for nonprofits
cyber security

Microsoft touts new cyber security help for nonprofits

22 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Royal Mint to recover gold from smartphones and laptops in world first
Technology

Royal Mint to recover gold from smartphones and laptops in world first

21 Oct 2021