CVE-2021-33318: Incorrect Type Conversion or Cast (CWE-704)
value: An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 9.8
Published: 2022-05-16T16:15Z
Repository: https://github.com/jchristn/IpMatcher
Language: C#
Files changed: IpMatcher/IpMatcher.csproj, IpMatcher/IpMatcher.xml, IpMatcher/Matcher.cs
Commit date: 2021-08-18 13:28:16 -0700
Commit message: NuGet v1.0.4.2, fix for SICK-2021-060

Diff: diff --git a/IpMatcher/IpMatcher.csproj b/IpMatcher/IpMatcher.csproj
index fe4d14a..2dbb5d9 100644
--- a/IpMatcher/IpMatcher.csproj
+++ b/IpMatcher/IpMatcher.csproj
@@ -1,25 +1,29 @@
 ﻿<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFrameworks>netstandard2.0;netstandard2.1;netcoreapp3.1;net452;net5.0</TargetFrameworks>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
-    <Version>1.0.4.1</Version>
+    <Version>1.0.4.2</Version>
     <Authors>Joel Christner</Authors>
     <Description>Library for maintaining a match list of IP addresses and networks and comparing inputs to see if a match exists.</Description>
     <Copyright>(c)2021 Joel Christner</Copyright>
     <PackageProjectUrl>https://github.com/jchristn/ipmatcher</PackageProjectUrl>
     <RepositoryUrl>https://github.com/jchristn/ipmatcher</RepositoryUrl>
     <RepositoryType>Github</RepositoryType>
     <PackageLicenseUrl></PackageLicenseUrl>
-    <PackageReleaseNotes>XML documentation</PackageReleaseNotes>
+    <PackageReleaseNotes>Fix for SICK-2021-060</PackageReleaseNotes>
     <PackageTags>ip address match netmask network mask subnet cidr</PackageTags>
     <PackageLicenseFile>LICENSE.md</PackageLicenseFile>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Release|netstandard2.0|AnyCPU'">
-    <DocumentationFile>C:\Code\Misc\IpMatcher\IpMatcher\IpMatcher.xml</DocumentationFile>
+    <DocumentationFile>IpMatcher.xml</DocumentationFile>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Debug|netstandard2.0|AnyCPU'">
+    <DocumentationFile>IpMatcher.xml</DocumentationFile>
   </PropertyGroup>
 
   <ItemGroup>
     <None Include="..\LICENSE.md">
       <Pack>True</Pack>
diff --git a/IpMatcher/IpMatcher.xml b/IpMatcher/IpMatcher.xml
index 736135f..64163d2 100644
--- a/IpMatcher/IpMatcher.xml
+++ b/IpMatcher/IpMatcher.xml
@@ -7,10 +7,15 @@
         <member name="T:IpMatcher.Matcher">
             <summary>
             IP address matcher.
             </summary>
         </member>
+        <member name="F:IpMatcher.Matcher.Logger">
+            <summary>
+            Method to invoke to send log messages.
+            </summary>
+        </member>
         <member name="M:IpMatcher.Matcher.#ctor">
             <summary>
             Instantiate the IP address matcher.
             </summary>
         </member>
@@ -40,7 +45,13 @@
             Check if an IP address matches something in the match list.
             </summary>
             <param name="ip">The IP address, i.e. 192.168.1.34.</param>
             <returns>True if a match is found.</returns>
         </member>
+        <member name="M:IpMatcher.Matcher.All">
+            <summary>
+            Retrieve all stored addresses.
+            </summary>
+            <returns></returns>
+        </member>
     </members>
 </doc>
diff --git a/IpMatcher/Matcher.cs b/IpMatcher/Matcher.cs
index 4f07034..e33d145 100644
--- a/IpMatcher/Matcher.cs
+++ b/IpMatcher/Matcher.cs
@@ -57,10 +57,13 @@ namespace IpMatcher
         public void Add(string ip, string netmask)
         {
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
             if (String.IsNullOrEmpty(netmask)) throw new ArgumentNullException(nameof(netmask));
 
+            ip = IPAddress.Parse(ip).ToString();
+            netmask = IPAddress.Parse(netmask).ToString();
+
             string baseAddress = GetBaseIpAddress(ip, netmask);
             IPAddress parsed = IPAddress.Parse(baseAddress);
             if (Exists(baseAddress, netmask)) return;
 
             lock (_AddressLock)
@@ -81,10 +84,13 @@ namespace IpMatcher
         public bool Exists(string ip, string netmask)
         {
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
             if (String.IsNullOrEmpty(netmask)) throw new ArgumentNullException(nameof(netmask));
 
+            ip = IPAddress.Parse(ip).ToString();
+            netmask = IPAddress.Parse(netmask).ToString();
+
             lock (_CacheLock)
             {
                 if (_Cache.ContainsKey(ip))
                 {
                     Log(ip + " " + netmask + " exists in cache");
@@ -114,10 +120,12 @@ namespace IpMatcher
         /// <param name="ip">The IP address, i.e 192.168.1.0.</param>
         public void Remove(string ip)
         {
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
 
+            ip = IPAddress.Parse(ip).ToString();
+
             lock (_CacheLock)
             {
                 _Cache = _Cache.Where(d => !d.Key.Equals(ip)).ToDictionary(d => d.Key, d => d.Value);
                 Log(ip + " removed from cache");
             }
@@ -138,10 +146,12 @@ namespace IpMatcher
         /// <returns>True if a match is found.</returns>
         public bool MatchExists(string ip)
         {
             if (String.IsNullOrEmpty(ip)) throw new ArgumentNullException(nameof(ip));
 
+            ip = IPAddress.Parse(ip).ToString();
+
             IPAddress parsed = IPAddress.Parse(ip);
 
             lock (_CacheLock)
             {
                 if (_Cache.ContainsKey(ip))

Vulnerable code:     <Version>1.0.4.1</Version>
    <PackageReleaseNotes>XML documentation</PackageReleaseNotes>
    <DocumentationFile>C:\Code\Misc\IpMatcher\IpMatcher\IpMatcher.xml</DocumentationFile>
Fixed code:     <Version>1.0.4.2</Version>
    <PackageReleaseNotes>Fix for SICK-2021-060</PackageReleaseNotes>
    <DocumentationFile>IpMatcher.xml</DocumentationFile>
  </PropertyGroup>

  <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Debug|netstandard2.0|AnyCPU'">
    <DocumentationFile>IpMatcher.xml</DocumentationFile>
        <member name="F:IpMatcher.Matcher.Logger">
            <summary>
            Method to invoke to send log messages.
            </summary>
        </member>
        <member name="M:IpMatcher.Matcher.All">
            <summary>
            Retrieve all stored addresses.
            </summary>
            <returns></returns>
        </member>
            ip = IPAddress.Parse(ip).ToString();
            netmask = IPAddress.Parse(netmask).ToString();

            ip = IPAddress.Parse(ip).ToString();
            netmask = IPAddress.Parse(netmask).ToString();

            ip = IPAddress.Parse(ip).ToString();

            ip = IPAddress.Parse(ip).ToString();