Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: ip
- Introduced through: proxy-agent@3.1.1
Detailed paths
-
Introduced through: @mechanicalrock/beady-eye@MechanicalRock/beady-eye#046fb13a7b94b935db5f630e1a4eb2288ec92030 › proxy-agent@3.1.1 › socks-proxy-agent@4.0.2 › socks@2.3.3 › ip@1.1.5Remediation: Upgrade to proxy-agent@4.0.0.
-
Introduced through: @mechanicalrock/beady-eye@MechanicalRock/beady-eye#046fb13a7b94b935db5f630e1a4eb2288ec92030 › proxy-agent@3.1.1 › pac-proxy-agent@3.0.1 › socks-proxy-agent@4.0.2 › socks@2.3.3 › ip@1.1.5Remediation: Upgrade to proxy-agent@4.0.0.
Overview
ip is a Node library.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the isPublic
function, by failing to identify hex-encoded 0x7f.1
as equivalent to the private addess 127.0.0.1
. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.
PoC
var ip = require('ip');
console.log(ip.isPublic("0x7f.1"));
//This returns true. It should be false because 0x7f.1 == 127.0.0.1 == 0177.1
Remediation
Upgrade ip
to version 1.1.9, 2.0.1 or higher.
References
high severity
- Vulnerable module: pac-resolver
- Introduced through: proxy-agent@3.1.1
Detailed paths
-
Introduced through: @mechanicalrock/beady-eye@MechanicalRock/beady-eye#046fb13a7b94b935db5f630e1a4eb2288ec92030 › proxy-agent@3.1.1 › pac-proxy-agent@3.0.1 › pac-resolver@3.0.0Remediation: Upgrade to proxy-agent@5.0.0.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE). This can occur when used with untrusted input, due to unsafe PAC file handling.
In order to exploit this vulnerability in practice, this either requires an attacker on your local network, a specific vulnerable configuration, or some second vulnerability that allows an attacker to set your config values.
NOTE: The fix for this vulnerability is applied in the node-degenerator
library, a dependency is written by the same maintainer.
PoC
const pac = require('pac-resolver');
// Should keep running forever (if not vulnerable):
setInterval(() => {
console.log("Still running");
}, 1000);
// Parsing a malicious PAC file unexpectedly executes unsandboxed code:
pac(`
// Real PAC config:
function FindProxyForURL(url, host) {
return "DIRECT";
}
// But also run arbitrary code:
var f = this.constructor.constructor(\`
// Running outside the sandbox:
console.log('Read env vars:', process.env);
console.log('!!! PAC file is running arbitrary code !!!');
console.log('Can read & could exfiltrate env vars ^');
console.log('Can kill parsing process, like so:');
process.exit(100); // Kill the vulnerable process
// etc etc
\`);
f();
Remediation
Upgrade pac-resolver
to version 5.0.0 or higher.
References
high severity
- Vulnerable module: netmask
- Introduced through: proxy-agent@3.1.1
Detailed paths
-
Introduced through: @mechanicalrock/beady-eye@MechanicalRock/beady-eye#046fb13a7b94b935db5f630e1a4eb2288ec92030 › proxy-agent@3.1.1 › pac-proxy-agent@3.0.1 › pac-resolver@3.0.0 › netmask@1.0.6Remediation: Upgrade to proxy-agent@4.0.0.
Overview
netmask is a library to parse IPv4 CIDR blocks.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). It incorrectly evaluates individual IPv4 octets that contain octal strings as left-stripped integers, leading to an inordinate attack surface on hundreds of thousands of projects that rely on netmask
to filter or evaluate IPv4 block ranges, both inbound and outbound.
For example, a remote unauthenticated attacker can request local resources using input data 0177.0.0.1
(127.0.0.1
), which netmask
evaluates as the public IP 177.0.0.1
.
Contrastingly, a remote authenticated or unauthenticated attacker can input the data 0127.0.0.01
(87.0.0.1
) as localhost, yet the input data is a public IP and can potentially cause local and remote file inclusion (LFI/RFI).
A remote authenticated or unauthenticated attacker can bypass packages that rely on netmask
to filter IP address blocks to reach intranets, VPNs, containers, adjacent VPC instances, or LAN hosts, using input data such as 012.0.0.1
(10.0.0.1
), which netmask
evaluates as 12.0.0.1
(public).
NOTE: This vulnerability has also been identified as: CVE-2021-29418
Remediation
Upgrade netmask
to version 2.0.1 or higher.
References
high severity
- Vulnerable module: netmask
- Introduced through: proxy-agent@3.1.1
Detailed paths
-
Introduced through: @mechanicalrock/beady-eye@MechanicalRock/beady-eye#046fb13a7b94b935db5f630e1a4eb2288ec92030 › proxy-agent@3.1.1 › pac-proxy-agent@3.0.1 › pac-resolver@3.0.0 › netmask@1.0.6Remediation: Upgrade to proxy-agent@4.0.0.
Overview
netmask is a library to parse IPv4 CIDR blocks.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). It incorrectly evaluates individual IPv4 octets that contain octal strings as left-stripped integers, leading to an inordinate attack surface on hundreds of thousands of projects that rely on netmask
to filter or evaluate IPv4 block ranges, both inbound and outbound.
For example, a remote unauthenticated attacker can request local resources using input data 0177.0.0.1
(127.0.0.1
), which netmask
evaluates as the public IP 177.0.0.1
.
Contrastingly, a remote authenticated or unauthenticated attacker can input the data 0127.0.0.01
(87.0.0.1
) as localhost, yet the input data is a public IP and can potentially cause local and remote file inclusion (LFI/RFI).
A remote authenticated or unauthenticated attacker can bypass packages that rely on netmask
to filter IP address blocks to reach intranets, VPNs, containers, adjacent VPC instances, or LAN hosts, using input data such as 012.0.0.1
(10.0.0.1
), which netmask
evaluates as 12.0.0.1
(public).
NOTE: This vulnerability has also been identified as: CVE-2021-28918
Remediation
Upgrade netmask
to version 2.0.1 or higher.
References
medium severity
- Vulnerable module: inflight
- Introduced through: jasmine@3.99.0
Detailed paths
-
Introduced through: @mechanicalrock/beady-eye@MechanicalRock/beady-eye#046fb13a7b94b935db5f630e1a4eb2288ec92030 › jasmine@3.99.0 › glob@7.2.3 › inflight@1.0.6
Overview
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres
function due to improperly deleting keys from the reqs
object after execution of callbacks. This behavior causes the keys to remain in the reqs
object, which leads to resource exhaustion.
Exploiting this vulnerability results in crashing the node
process or in the application crash.
Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.
To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.
PoC
const inflight = require('inflight');
function testInflight() {
let i = 0;
function scheduleNext() {
let key = `key-${i++}`;
const callback = () => {
};
for (let j = 0; j < 1000000; j++) {
inflight(key, callback);
}
setImmediate(scheduleNext);
}
if (i % 100 === 0) {
console.log(process.memoryUsage());
}
scheduleNext();
}
testInflight();
Remediation
There is no fixed version for inflight
.