GHSA-pc5p-h8pf-mvwp
Machine-In-The-Middle in https-proxy-agent
- Severity
- 6.1 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-300 Channel Accessible by Non-Endpoint
- Fix
2.2.3- Upgrade https-proxy-agent to this version or later
Description
Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
Recommendation
Upgrade to version 3.0.0 or 2.2.3.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| https-proxy-agent | < 2.2.3 |
2.2.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
https-proxy-agent npm → 2.2.3
- npm
npm install https-proxy-agent@2.2.3- yarn
yarn add https-proxy-agent@2.2.3- pnpm
pnpm add https-proxy-agent@2.2.3
Severity breakdown
CVSS 3.1 6.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- Attack vector
- Adjacent
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-300: Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
How to prevent it
- Implementation: Always fully authenticate both ends of any communications channel.
- Architecture and Design: Adhere to the principle of complete mediation.
- Implementation: A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.
References
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8g7p-74h8-hg48 Denial of Service in https-proxy-agent | Critical | Also affects https-proxy-agent |
| GHSA-cgvx-9447-vcch ntlk unsafe deserialization vulnerability | Critical | Same weakness, CWE-300 |
| GHSA-f7w7-6pjc-wwm6 Apache Tomcat affected by vulnerability in TLS and SSL protocol | Critical | Same weakness, CWE-300 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor