Severity: high

Machine-In-The-Middle

https-proxy-agent

Overview

Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.

Remediation

Upgrade to version 3.0.0 or 2.2.3.

Resources

Have content suggestions? Send them to [email protected]

Advisory timeline

  1. published

    Advisory Published
    Oct 18th, 2019
  2. reported

    Reported by Kris Adler
    Sep 26th, 2019