Security researchers have discovered a bug in the networking npm library netmask that enables hackers to bypass servers’ access controls and launch server-side request forgery attacks.
According to researchers at Sick Codes, hundreds of thousands of applications use the package to parse or compare IPv4 addresses and Classless Inter-Domain Routing (CIDR) blocks.
The problem is extensive because over 278,000 GitHub repositories use the code, which users downloaded over three million times last week alone. Researchers said the flaw has existed for over nine years.
The problem stems from the way netmask handles mixed-format IP addresses. When parsing an IP address with a leading zero, node-netmask sees a different IP address due to incorrect in-place validation.
An IP address can be represented in various formats, including hexadecimal and integer, although the most common IPv4 addresses are expressed in decimal format.
For example, an IPv4 address represented in decimal format as 86.136.177.134 can be expressed in an octal format as 0126.0210.0261.0206. By prefixing the IPv4 address with a 0, pressing enter or returning will change the IP address to its decimal equivalent, 87.0.0.1, which is how most applications should handle such ambiguous IP addresses.
In the case of the netmask npm library, it’ll strip and discard any leading zeros. According to the original IETF specification, portions of an IPv4 address can be interpreted as octal if preceded by a "0" prefix.
The researchers warned that anyone could submit an address in netmask that looks like a private IP, but it connects to a public IP to download malicious files.
“If your browser recognizes octal literals, but a NodeJS application does not, users can submit all kinds of malevolent URLs that seem internal, but really go to remote files.
On the other hand, users can ALSO submit URLs that seem public, but they’re actually very private!” said researchers.
While the vulnerability seems insignificant, if an attacker can interfere with the IP address input analyzed by the application, the problem could lead to various other attacks, from Server-Side Request Forgery (SSRF) to remote access.
Remote workforce security report
Key challenges, security threats, and investment priorities of organisations during the pandemic
Researchers have reported the vulnerability to node-netmask developer Olivier Poitrey, who posted a series of fixes for the GitHub repository issue. Experts recommend netmask npm library users upgrade to version 2.0.0.
Ax Sharma, a security researcher at Sonatype, told ITPro that the vulnerability means hundreds of thousands of applications that rely on popular open source components, like this one, may not realize they could be potentially vulnerable to anti-Server-Side Request Forgery (SSRF) bypasses or remote file inclusion (RFI) should they be purely relying on netmask for parsing IP addresses, without adding their own proper input sanitization and normalization checks.
“This highlights the need for proper input hygiene and never trusting input no matter the source. In this case, for example, the fixes [1, 2] applied to netmask now take into account that IP addresses can also be provided in octal or hexadecimal formats, something users of netmask could also have implemented on their end as an extra precaution,” Sharma said.
