CVE-2021-28918 PoC — Npm netmask 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28918.yaml

Associated Vulnerability

Title:Npm netmask 代码问题漏洞 (CVE-2021-28918)
Description:npm Npm netmask是美国npm公司的一个应用软件。Netmask类解析并了解IPv4 CIDR块，以便可以对其进行探索和比较。 Npm netmask 存在代码问题漏洞，攻击者可利用该漏洞输入数据触发跨站请求伪造，以迫使受害者执行操作。

Description

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

File Snapshot


 id: CVE-2021-28918

info:
  name: Netmask NPM Package - Server-Side Request Forgery
  author: johnjh

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!