Improper Handling of Undefined Values Affecting proxy package, versions <2.1.1
Snyk CVSS
Attack Complexity
Low
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (19th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PROXY-5661790
- published 31 May 2023
- disclosed 31 May 2023
- credit Ori Hollander
Introduced: 31 May 2023
CVE-2023-2968 Open this link in a new tabHow to fix?
Upgrade proxy to version 2.1.1 or higher.
Overview
proxy is an An HTTP proxy written with Node.js (think Squid)
Affected versions of this package are vulnerable to Improper Handling of Undefined Values which allows the attacker to trigger a denial of service via the socket.remoteAddress variable. Exploiting this vulnerability is possible by sending a crafted HTTP request.
PoC
import * as http from 'http';
import { createProxy } from 'proxy';
const server = createProxy(http.createServer());
server.listen(31285, () => {
var port = server.address().port;
console.log('HTTP(s) proxy server listening on port %d',
port);
});
An attacker can crash the program by sending a valid HTTP GET request followed by invalid tail data