PT-2021-15497 · Npm · Pac-Resolver

Tim Perry · Published 2021-08-24 · Updated 2021-09-13 · CVE-2021-23406

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pac-resolver versions prior to 5.0.0

Description This issue occurs due to unsafe PAC file handling when used with untrusted input, allowing for potential remote code execution. The pac-resolver package has over 3 million weekly downloads, and the vulnerability can be exploited in Node.js applications that support auto-proxy configuration.

Recommendations For versions prior to 5.0.0, the fix for this issue is applied in the node-degenerator library, a dependency written by the same maintainer. As a temporary workaround, consider disabling the use of untrusted input with the pac-resolver package until the issue is resolved. Restrict access to the pac-resolver package to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-23406

GHSA-9J49-MFVP-VMHM

SNYK-JAVA-ORGWEBJARSNPM-1568506

SNYK-JS-PACRESOLVER-1564857

Affected Products

Pac-Resolver

References · 16

• 🔥 https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506 · Exploit
• https://github.com/TooTallNate/node-pac-resolver/releases/tag/5.0.0 · Patch
• https://github.com/TooTallNate/node-degenerator/commit/9d25bb67d957bc2e5425fea7bf7a58b3fc64ff9e · Patch
• https://github.com/TooTallNate/node-degenerator/commit/ccc3445354135398b6eb1a04c7d27c13b833f2d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23406 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23406 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9j49-mfvp-vmhm · Vendor Advisory
• https://t.me/tmfeed/120455 · Telegram Post
• https://t.me/cvenotify/19978 · Telegram Post
• https://t.me/cvenotify/19974 · Telegram Post
• https://t.me/cibsecurity/27756 · Telegram Post
• https://t.me/opennews/8976 · Telegram Post
• https://github.com/TooTallNate · Note
• https://t.me/thehackernews/1508 · Telegram Post