3 ms·

This bug is not NPM’s nor JavaScript’s fault. It’s mostly due to bad specifications of how IPv4 addresses are represented in text. The writeup at https://www.b

by fanf2 6y ago

This bug is not NPM’s nor JavaScript’s fault. It’s mostly due to bad specifications of how IPv4 addresses are represented in text. The writeup at https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ https://www.bleepingcomputer.com/news/security/critical-netm... has a link to an informative ancient expired IETF draft https://tools.ietf.org/html/draft-main-ipaddr-text-rep https://tools.ietf.org/html/draft-main-ipaddr-text-rep which describes how things stood in 2003. A more recent and more official RFC from the IETF on the security implications of inconsistent parsers discusses the issue behind this CVE https://tools.ietf.org/html/rfc6943#section-3.1.1 https://tools.ietf.org/html/rfc6943#section-3.1.1 The problem is that for a very long time the IETF did not specify the textual syntax of IPv4 addresses, and the POSIX specification for parsing dotted quads is bonkers. I think it is unfortunate that they fixed the bug by aligning with inet_aton()’s ancient foolish support for octal, instead of inet_pton()’s newer strict decimal syntax, forbidding leading zeroes.

jtdev 6y ago
Based on your comment, should we expect this vulnerability in comparable packages from other languages/communities? Or is this an NPM/JS maturity issue, i.e., “it’s not my fault, fix the spec.”?
- FDSGSG 6y ago
  This is a super common bug.
- fanf2 6y ago
  It’s obscure enough that I would expect this bug to turn up elsewhere, even though it’s an example of a fundamental security risk of parsers that don’t accept the same syntax (http://langsec.org/ http://langsec.org/), and IPv4 addresses are a specific instance of this risk that has been written about for years. (Tho usually the weirdness of inet_aton() is treated as quirky rather than dangerous.) I like the twist in the vulnerability report, using differences between IPv4 parsers to get past protections against things like SSRF, which I don’t think is explicitly mentioned in the IETF draft and RFC that I linked to.
  - fanf2 6y ago
    And as predicted, the issue is turning up in other places, for instance https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-... (comments https://news.ycombinator.com/item?id=26628827 https://news.ycombinator.com/item?id=26628827)
xucheng 6y ago
A simple test shows that this bug is in Rust std library. https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=a8982ed52005c4560bc695ab0fb1daed https://play.rust-lang.org/?version=stable&mode=debug&editio... Report the issue in https://github.com/rust-lang/rust/issues/83648 https://github.com/rust-lang/rust/issues/83648

by fanf2 6y ago

jtdev 6y ago

Based on your comment, should we expect this vulnerability in comparable packages from other languages/communities? Or is this an NPM/JS maturity issue, i.e., “it’s not my fault, fix the spec.”?

FDSGSG 6y ago
This is a super common bug.
fanf2 6y ago
It’s obscure enough that I would expect this bug to turn up elsewhere, even though it’s an example of a fundamental security risk of parsers that don’t accept the same syntax (http://langsec.org/ http://langsec.org/), and IPv4 addresses are a specific instance of this risk that has been written about for years. (Tho usually the weirdness of inet_aton() is treated as quirky rather than dangerous.) I like the twist in the vulnerability report, using differences between IPv4 parsers to get past protections against things like SSRF, which I don’t think is explicitly mentioned in the IETF draft and RFC that I linked to.
- fanf2 6y ago
  And as predicted, the issue is turning up in other places, for instance https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-... (comments https://news.ycombinator.com/item?id=26628827 https://news.ycombinator.com/item?id=26628827)

xucheng 6y ago

A simple test shows that this bug is in Rust std library. https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=a8982ed52005c4560bc695ab0fb1daed https://play.rust-lang.org/?version=stable&mode=debug&editio... Report the issue in https://github.com/rust-lang/rust/issues/83648 https://github.com/rust-lang/rust/issues/83648