2266
Kelly wants to set up monitoring systems for his two cats, who pose very different threats. One
cat, Night, tweets embarrassing or critical comments about his owner in ways that could cause
reputational damage, so Night's blog needs to be monitored regularly. The other cat, Taki, likes
to distract Kelly and his coworkers during business meetings with cute meows, so Kelly monitors
Taki's location using a different web site.
Suppose /etc/hosts provides the site info as follows:
Example Language: Other (Bad)
taki.example.com 10.1.0.7
night.example.com 010.1.0.8
The entry for night.example.com has a typo "010" in the first octet. When using ping to ensure
the servers are up, the leading 0 causes the IP address to be converted using octal. So when
Kelly's script attempts to access night.example.com, it inadvertently scans 8.1.0.8 instead of
10.1.0.8 (since "010" in octal is 8 in decimal), and Night is free to send new Tweets without being
immediately detected.
Observed Examples
Reference Description
CVE-2021-29662 Chain: Use of zero-prepended IP addresses in Perl-based IP validation module
can lead to an access control bypass.
https://www.cve.org/CVERecord?id=CVE-2021-29662
CVE-2021-28918 Chain: Use of zero-prepended IP addresses in a product that manages IP
blocks can lead to an SSRF.
https://www.cve.org/CVERecord?id=CVE-2021-28918
CVE-2021-29921 Chain: Use of zero-prepended IP addresses in a Python standard library
package can lead to an SSRF.
https://www.cve.org/CVERecord?id=CVE-2021-29921
CVE-2021-29923 Chain: Use of zero-prepended IP addresses in the net Golang library can lead
to an access control bypass.
https://www.cve.org/CVERecord?id=CVE-2021-29923
CVE-2021-29424 Chain: Use of zero-prepended IP addresses in Perl netmask module allows
bypass of IP-based access control.
https://www.cve.org/CVERecord?id=CVE-2021-29424
CVE-2016-4029 Chain: incorrect validation of intended decimal-based IP address format
(CWE-1286) enables parsing of octal or hexadecimal formats (CWE-1389),
allowing bypass of an SSRF protection mechanism (CWE-918).
https://www.cve.org/CVERecord?id=CVE-2016-4029
CVE-2020-13776 Mishandling of hex-valued usernames leads to unexpected decimal conversion
and privilege escalation in the systemd Linux suite.
https://www.cve.org/CVERecord?id=CVE-2020-13776
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
References
[REF-1284]Sick Codes. "Universal "netmask" npm package, used by 270,000+ projects, vulnerable
to octal input data". 2021 March 8. < https://sick.codes/universal-netmask-npm-package-usedCWE
Version 4.14
CWE-1390: Weak Authentication
CWE-1390: Weak Authentication