Pac-proxy-agent offers Node.js developers a powerful way to manage proxy connections using PAC (Proxy Auto-Configuration) files. Comparing version 5.0.0 with the older 4.1.0, reveals subtle but important updates for developers. Both versions share the core functionality of providing an http.Agent implementation that respects PAC file configurations, allowing applications to seamlessly switch between different proxy servers based on the target URL, ideal for complex network environments or situations requiring dynamic proxy selection.
Key dependencies like debug, get-uri, raw-body, agent-base, http-proxy-agent, @tootallnate/once, https-proxy-agent, and socks-proxy-agent remain consistent, ensuring backwards compatibility for most use cases. The crucial difference lies in the pac-resolver dependency: version 5.0.0 upgrades to pac-resolver ^5.0.0, while 4.1.0 relies on pac-resolver ^4.1.0. This implies that the newer pac-proxy-agent version benefits from the improvements, bug fixes, and potentially new features introduced in the newer pac-resolver.
For developers, upgrading to pac-proxy-agent 5.0.0 means leveraging the latest proxy resolution logic and potentially enhanced performance offered by pac-resolver 5.x. While the core API remains the same, users are encouraged to review the pac-resolver CHANGELOG for details on the specific changes since version 4.x. The development dependencies remain identical, indicating a focus on code quality and consistent testing practices across both versions. Consider the upgrade the next time you want to enable PAC file proxying in node code.
All the vulnerabilities related to the version 5.0.0 of the package
vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
None.
None.
PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
None.
None.
PoC is to be disclosed on or after the 5th of September.
While this advisory might look similar to CVE-2023-37466, it is a completely different way of escaping the sandbox.
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
ip SSRF improper categorization in isPublic
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
