EIQ-2019-0037

EIQ-2019-0037

-

https-proxy-agent could enable main-in-the-middle attacks

23 Oct 2019

2 - MEDIUM

6.1

2.7.0

https-proxy-agent versions 2.2.2 and earlier can enable man-in-the-middle (MitM) attacks.

The module implements Node.js http.Agent connectivity functionality through the HTTP CONNECT method and a proxy server.
If the connect request targets a secure (HTTPS) endpoint, and if it returns a response with an HTTP status code other than 200/OK, https-proxy-agent does not upgrade to TLS.
This exposes the request data, because it is transmitted over an unencrypted connection.

An attacker with access to the proxy server, and with the ability to obtain a TCP data dump, could intercept the request data.
The data may contain basic authentication details, or other authentication credential information.
The attacker could retrieve this data, and use it to impersonate the requesting client.

Upgrade to http-proxy-agent versions 2.2.3, 3.0.0, or later.

2.6.0 and earlier.

For more information, see:

• Snyk report about the vulnerability

• Hackerone report about the vulnerability

• npm advisory about the vulnerability

• GitHub PR with the fix

• GitHub commit with the fix