Proxy-agent version 6.2.2 is a minor update to the popular Node.js package designed to simplify the use of HTTP, HTTPS, and SOCKS proxies within your applications. Comparing it to the previous stable version, 6.2.1, the core functionality remains consistent: proxy-agent intelligently maps proxy protocols based on the provided URL, abstracting away the complexities of managing different agent implementations. Developers can continue to rely on its robust handling of environment variables like http_proxy, https_proxy, and no_proxy via its dependency on proxy-from-env, and benefit from the consistent API provided by agent-base.
The key change in 6.2.2 lies within its dependency updates. Specifically, pac-proxy-agent has been bumped from version 6.0.3 to 6.0.4. While this appears minor, such updates often include critical bug fixes, performance improvements or security patches within pac-proxy-agent itself, enhancing the reliability of proxy auto-configuration (PAC file) support within the broader proxy-agent package. Developers leveraging PAC files for proxy resolution should particularly benefit from this update. The consistent dependency requirements for http-proxy-agent, https-proxy-agent, and socks-proxy-agent suggest a stable base for core proxying capabilities. The update from version 6.2.1 to 6.2.2 ensures that users can incorporate this enhancement without introducing breaking changes to their existing implementations.
All the vulnerabilities related to the version 6.2.2 of the package
vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
None.
None.
PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
None.
None.
PoC is to be disclosed on or after the 5th of September.
While this advisory might look similar to CVE-2023-37466, it is a completely different way of escaping the sandbox.
If you have any questions or comments about this advisory:
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
ip SSRF improper categorization in isPublic
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
