Executive brief
https-proxy-agent is a Node.js library used to proxy HTTPS connections through HTTP proxies. The vulnerability allows an attacker with access to the proxy server to intercept encrypted communications by exploiting improper TLS enforcement when the proxy returns non-200 HTTP status codes, potentially exposing credentials and other sensitive data.
Technical details
The vulnerability is a man-in-the-middle flaw in https-proxy-agent (CWE-300) where the library fails to properly enforce TLS when the HTTP proxy server responds with a status code other than 200. An attacker with network access to the proxy server can downgrade the connection to unencrypted HTTP, allowing interception of sensitive data including credentials and application payloads. The vulnerability affects all versions prior to 2.2.3 and was fixed by using an EventEmitter to properly replay failed proxy connect requests instead of attempting to forward them directly. The fix ensures the node core HTTP client does not write requests intended for the destination server to the proxy server when a non-200 response is received.
Affected products
- npm https-proxy-agent before 2.2.3
Timeline
- 2020-04-16: disclosed