GitHub Advisoryadvisory · npm

GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent

MEDIUM Published 2020-04-16 Modified 2023-11-01 Official page ↗
Ecosystem
npm
Packages
https-proxy-agent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-300
Reviewed
2020-04-16

Affected packages

• npm https-proxy-agent: < 2.2.3 → fixed in 2.2.3

Description

Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials. Recommendation Upgrade to version 3.0.0 or 2.2.3.

Related

Weakness · CWE (1)

  • CWE-300 Channel Accessible by Non-Endpoint weakness

References