CVE-2021-47154
Medium · 6.3CVSS
6.3
EPSS
0.5%
Published
Mar 18, 2024
CISA due date
—
Cloudanix analysis
A Perl component used to decide which computers can reach a system can be tricked by writing an address with extra zeros at the front, letting the wrong computers through.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Privilege Gain
- Component
- Library
- Class
- Authorization Bypass
- Remediation
- Upgrade
- Effort
- Low
- Patch risk
- Low
What it actually does
The module fails to normalize IP address strings containing leading zero characters, causing CIDR-based access control checks to treat equivalent addresses as distinct and allow unauthorized matches or mismatches.
Why it matters to the business
Organizations relying on Perl-based IP filtering for network or application access control face risk of unauthorized entry, which could expose internal resources; low urgency given no known exploitation and stable low exploit probability.
How an attack unfolds
An attacker identifies a system using an affected version of the module for IP allow-listing, then submits a request using an IP string prefixed with extraneous zeros (for example, 010.0.0.1) that the module does not equate to the canonical form, thereby evading the intended restriction.
How to fix it
Upgrade Net::CIDR::Lite to version 0.22 or later. For AlmaLinux 8, update NetworkManager-libnm-devel to 1:1.30.0-10.el8_4 or newer. For the GIT package, apply commit 23b6ff0590dc279521863a502e890ef19a5a76fc or later release.
How to confirm the fix worked
Confirm installed module version is at least 0.22; test authorization behavior with both canonical and leading-zero IP representations to verify consistent enforcement.
Typical attack path
- Identify target endpoint or service that performs IP-based authorization using Net::CIDR::Lite
- Craft request containing IP address literal with one or more leading zero octets
- Submit request to the protected resource
- Bypass occurs when the module's comparison fails to normalize the address, granting access
How to detect it
Search web, application, and authentication logs for IP address literals containing leading zeros in octets; correlate with successful access events to resources protected by the module.
What your security team should do
- Apply the listed fixed versions across all Perl environments using the module
- Review and replace any custom IP allow-list logic that depends on this module
- Add automated dependency scanning to detect future vulnerable versions of Net::CIDR::Lite
- Monitor upstream Perl module releases for related normalization issues
The record
The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | libnet-cidr-lite-perl | 0 | 0.21-2+debu10u1 |
| Debian:11 | libnet-cidr-lite-perl | 0 | 0.22-1 |
| Debian:12 | libnet-cidr-lite-perl | 0 | 0.22-1 |
| Debian:13 | libnet-cidr-lite-perl | 0 | 0.22-1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | perl-Net-CIDR-Lite | 0 | 0.21-150100.6.3.1 |
| Ubuntu:16.04:LTS | libnet-cidr-lite-perl | 0 | No fix |
| Ubuntu:18.04:LTS | libnet-cidr-lite-perl | 0 | No fix |
| Ubuntu:20.04:LTS | libnet-cidr-lite-perl | 0 | 0.21-2ubuntu0.1 |
| Ubuntu:22.04:LTS | libnet-cidr-lite-perl | 0 | 0.22-1 |
| Ubuntu:Pro:16.04:LTS | libnet-cidr-lite-perl | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libnet-cidr-lite-perl | 0 | No fix |
| openSUSE:Leap 15.5 | perl-Net-CIDR-Lite | 0 | 0.21-150100.6.3.1 |