Executive brief
pac-resolver is a JavaScript library used to evaluate Proxy Auto-Config (PAC) files, which are scripts that determine proxy settings for web traffic. The library contains a code injection vulnerability when handling untrusted PAC files, allowing an attacker to execute arbitrary code within applications that use this library with malicious or untrusted PAC input. This could lead to full compromise of systems relying on this library for proxy configuration.
Technical details
The vulnerability is a code injection (CWE-94) in pac-resolver before version 5.0.0 due to unsafe handling of PAC files. The root cause is inadequate input sanitization when processing PAC scripts, which are evaluated as code. An attacker with the ability to provide or control untrusted PAC files can inject malicious code that will be executed with the privileges of the application using pac-resolver. The attack vector is network-based (untrusted input delivery) with no authentication required. The fix is available in pac-resolver version 5.0.0 and later, which addresses the vulnerability by fixing the underlying node-degenerator dependency.
Affected products
- npm pac-resolver before 5.0.0
- npm degenerator before 3.0.1
Timeline
- 2021-08-24: disclosed: CVE-2021-23406 published by NVD
- 2021-09-02: advisory: GHSA-9j49-mfvp-vmhm published
- 2021: patched: pac-resolver 5.0.0 released with fix; degenerator 3.0.1 released with fix