Executive brief
tunnel-agent is a Node.js library that handles HTTP tunneling and proxy connections. When a numeric value is passed as the proxy authentication credential, the library allocates uninitialized memory containing sensitive data (such as encryption keys or session tokens) and transmits it over the network, potentially exposing confidential information to unauthorized parties.
Technical details
This vulnerability stems from improper use of the Node.js Buffer constructor with numeric arguments. When user-supplied input that is a number is passed to the proxy auth parameter, the code calls new Buffer(connectOptions.proxyAuth) with a numeric value, which allocates uninitialized memory of that size rather than converting the input to a string. This uninitialized memory is then base64-encoded and included in the Proxy-Authorization header. The vulnerability is rooted in CWE-200 (Information Exposure). The fix, deployed in version 0.6.0, replaces the deprecated new Buffer() constructor with Buffer.from(), which properly handles type conversion and prevents memory allocation from numeric arguments.
Affected products
- npm tunnel-agent before 0.6.0
Timeline
- 2019-06-03: disclosed: Advisory published on GitHub Security Advisory database