Executive brief
xmlhttprequest-ssl is a Node.js library that enables HTTPS requests with certificate handling. Before version 1.6.1, the library disabled SSL certificate validation by default, allowing attackers to perform man-in-the-middle attacks and intercept encrypted communications without detection. This could lead to exposure of sensitive data transmitted over HTTPS connections.
Technical details
The vulnerability stems from improper handling of the rejectUnauthorized parameter in the https.request function. When rejectUnauthorized is undefined, Node.js treats it as false, which disables certificate validation entirely rather than defaulting to the secure behavior of rejecting unauthorized certificates. This is a CWE-295 (Improper Certificate Validation) issue affecting all versions before 1.6.1. The vulnerability requires network access but no authentication or user interaction. An attacker on the network path can perform man-in-the-middle attacks to intercept and modify HTTPS traffic. The fix in version 1.6.1 explicitly sets rejectUnauthorized to true by default.
Affected products
- xmlhttprequest-ssl xmlhttprequest-ssl before 1.6.1
Timeline
- 2021-04-23: disclosed
- 2021-05-20: patched: Version 1.6.1 released with fix