Pac-proxy-agent is an npm package that acts as a PAC file proxy HTTP agent. Versions 6.0.3 and 6.0.4 share identical functionality and dependency structures, providing developers with a seamless experience regardless of the chosen version. Both versions maintain the core dependencies required for proxy resolution and agent management, including debug for logging, get-uri for fetching PAC files, agent-base for foundational agent functionality, pac-resolver for actual PAC resolution, and http-proxy-agent, https-proxy-agent, and socks-proxy-agent to create agents for different proxy types. The development dependencies, crucial for testing and building, are also consistent including jest, proxy, and typescript, ensuring a maintained and modern development environment.
The key difference between the versions lies in their release dates. Version 6.0.4 was released on July 13, 2023 while version 6.0.3 was released on May 25, 2023. The file count and packed size is the same. Potentially, the newer release could include bug fixes or minor performance improvements in version 6.0.4 that might not be reflected in the metadata. Developers should always consult the project's changelog or commit history for detailed information about updates. Given the matching dependency structure, developers can confidently use either version, prioritizing the latest release (6.0.4) offering the most recent patches and enhancements for optimal performance, or 6.0.3 if earlier stability is prioritized.
All the vulnerabilities related to the version 6.0.4 of the package
vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
None.
None.
PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
None.
None.
PoC is to be disclosed on or after the 5th of September.
While this advisory might look similar to CVE-2023-37466, it is a completely different way of escaping the sandbox.
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
ip SSRF improper categorization in isPublic
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
