Executive Summary

Net::CIDR::Lite versions before 0.24 for Perl do not properly validate IP address and CIDR mask inputs. This improper validation allows inputs containing trailing newline or non-ASCII digit characters to pass the validators. However, these inputs are then re-encoded by the parser to a different address than the input string spelled.

As a result, the find() and bin_find() functions may incorrectly match or miss addresses, potentially allowing IP Access Control List (ACL) bypass.

For example, adding the address "::1\n/128" and then searching for "::1a" incorrectly returns true, demonstrating the bypass.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to bypass IP-based access control lists (ACLs). Because the input validation is flawed, malicious inputs can be crafted to evade IP filtering rules.

This means unauthorized users or systems might gain access to resources or services that are supposed to be restricted based on IP addresses.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from improper validation of IP address and CIDR mask inputs in Net::CIDR::Lite versions before 0.24 for Perl, which may allow IP ACL bypass. Detection involves checking if your system or network uses a vulnerable version of Net::CIDR::Lite.

Since the issue is in the Perl module's handling of IP addresses with trailing newline or non-ASCII digit characters, you can test for the vulnerability by running Perl scripts that add such inputs and check if the find() method incorrectly returns true.

Example test commands in Perl might include:

• my $cidr = Net::CIDR::Lite->new();
• $cidr->add("::1\n/128");
• $cidr->find("::1a"); # should not return true if not vulnerable

If the find() method returns true for such inputs, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Net::CIDR::Lite to version 0.24 or later, where proper validation of IP address and CIDR mask inputs is implemented.

Until an upgrade is possible, avoid using inputs containing trailing newlines or non-ASCII digit characters in IP address or CIDR mask fields to prevent ACL bypass.

Useful 0 Not Useful 0