# Proxies are complicated: RCE vulnerability in a 3 million downloads/week NPM package

DevFeed: [Proxies are complicated: RCE vulnerability in a 3 million downloads/week NPM package](<https://devfeed.tech/articles/proxies-are-complicated-rce-vulnerability-in-a-3-million-downloads-week-npm-package-19089.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/npm-pac-proxy-agent-vulnerability/>)

Author: HTTP Toolkit; Tim Perry

Published: 2021-08-31T11:00:00Z

Content type: article

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Network](<https://devfeed.tech/topics/network.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Firebase](<https://devfeed.tech/topics/firebase.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [cli](<https://devfeed.tech/tags/cli.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [env-file-security](<https://devfeed.tech/tags/env-file-security.md>), [firebase](<https://devfeed.tech/tags/firebase.md>), [firebase-cli](<https://devfeed.tech/tags/firebase-cli.md>), [github](<https://devfeed.tech/tags/github.md>), [http](<https://devfeed.tech/tags/http.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [network](<https://devfeed.tech/tags/network.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm](<https://devfeed.tech/tags/npm.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [remote-code-execution-vulnerability](<https://devfeed.tech/tags/remote-code-execution-vulnerability.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The article examines CVE-2021-23406, a high-severity remote code execution vulnerability in the Pac-Resolver NPM dependency. The issue can affect Node.js applications using untrusted PAC or proxy configuration, and was fixed in Pac-Resolver v5.0.0 and related packages.

## Source excerpt

Pac-Resolver, a widely used NPM dependency, had a high-severity RCE (Remote Code Execution) vulnerability that could allow network administrators or other malicious actors on your local network to remotely run arbitrary code inside your Node.js process whenever you tried to send an HTTP request. This is bad! This package is used for PAC file support in Pac-Proxy-Agent, which is used in turn in Proxy-Agent, which then used all over the place as the standard go-to package for HTTP proxy autodetection & configuration in Node.js. It's very popular: Proxy-Agent is used everywhere from AWS's CDK toolkit to the Mailgun SDK to the Firebase CLI (3 million downloads per week in total, and 285k public dependent repos on GitHub). I found this lovely little issue a short while back, while adding proxy support to HTTP Toolkit (yes, code reviewing your dependencies is a good idea!). The vulnerability was fixed in v5.0.0 of all those packages recently, and was formally disclosed last week as CVE-2021-23406. First things first: are you personally at risk? This vulnerability seriously affects you if: You depend on Pac-Resolver before v5.0.0 (even transitively) in a Node.js application And, you do one of the below: Explicitly use PAC files for proxy configuration. Read & use the operating system proxy configuration in Node.js, on systems with WPAD enabled. Use proxy configuration (env vars, config files, remote config endpoints, command-line arguments) from any other source that you wouldn't 100% trust to freely run code on your computer. In any of those cases, an attacker (by configuring a malicious PAC URL, intercepting PAC file requests with a malicious file, or using WPAD) can remotely run arbitrary code on your computer any time you send an HTTP request using this proxy configuration. If you're in this situation, you need to update (to Pac-Resolver v5 and/or Proxy-Agent v5) right now. If not, you're probably not in any immediate risk (but it's a good idea to update anyway). For n