GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent
Attackers can intercept unencrypted traffic via MITM if the proxy returns non-200 status, exposing sensitive data like credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pc5p-h8pf-mvwp?
GHSA-pc5p-h8pf-mvwp is a vulnerability in https-proxy-agent, published on 16 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
Recommendation
Upgrade to version 3.0.0 or 2.2.3.
Which versions are affected by GHSA-pc5p-h8pf-mvwp?
2 open source packages ship an affected version, including https-proxy-agent.
| Package | Affected | Fixed in |
|---|---|---|
https-proxy-agent npm | All versions | 2.2.3 |
https-proxy-agent npm | All versions | 2.2.3 |
How do I fix GHSA-pc5p-h8pf-mvwp?
Upgrade https-proxy-agent to 2.2.3 or later.
Is GHSA-pc5p-h8pf-mvwp being exploited?
There is no known exploitation of GHSA-pc5p-h8pf-mvwp in the wild and no public exploit code.