Cybersecurity researchers have found a high-severity remote code execution (RCE) vulnerability inside a widely used NPM package named Pac-Resolver.
“This package is used for PAC file support in Pac-Proxy-Agent, which is used in turn in Proxy-Agent, which then used all over the place as the standard go-to package for HTTP proxy autodetection & configuration in Node.js. It’s very popular,” writes Perry.
He adds that Proxy-Agent clocks about three million downloads per week, and exists in 285,000 public dependent repos on GitHub.
Affects countless apps
In his post, Perry explains that the vulnerability, tracked as CVE-2021-23406, could enable bad actors to remotely run arbitrary code on your computer whenever you send an HTTP request.
Further explaining the conditions that make Node.js apps prone to exploitation, Perry says the vulnerability affects all Pac-Resolver users who explicitly use PAC files for proxy configuration, or read and use the operating system proxy configuration on systems that use the WPAD protocol, or use proxy configuration from an untrusted source.
In a way, Perry believes the vulnerability affects anyone who uses the Pac-Resolver package in their apps.
“If you’re in this situation, you need to update (to Pac-Resolver v5 and/or Proxy-Agent v5) right now,” suggests Perry.