Executive brief
A vulnerability in the 'proxy' npm package can allow a remote attacker to crash the proxy service. By sending a specifically crafted HTTP request, an attacker can trigger a software error that shuts down the application. This results in a denial of service, preventing legitimate users from accessing the network resources managed by the proxy.
Technical details
The 'proxy' npm package (maintained by TooTallNate) is vulnerable to a Denial of Service (DoS) due to improper handling of undefined values. Specifically, a crafted HTTP request can cause the 'socket.remoteAddress' variable to be undefined. When the application attempts to use this undefined variable, it raises a TypeError exception, crashing the process. This is reachable over the network without authentication. The issue is fixed in version 2.1.1.
Affected products
- TooTallNate proxy >= 2.0.0, < 2.1.1
Timeline
- 2023-05-30: disclosed
- 2023-05-30: advisory
- 2023-05-30: patched: Version 2.1.1 released
References
- https://api.github.com/users/TheeCryptoChad
- https://github.com/TheeCryptoChad
- https://api.github.com/users/TheeCryptoChad/gists%7B/gist_id%7D
- https://api.github.com/users/TheeCryptoChad/repos
- https://avatars.githubusercontent.com/u/54559164?v=4
- https://api.github.com/users/TheeCryptoChad/events%7B/privacy%7D