GHSA-pc5p-h8pf-mvwp: 
JavaScript vulnerability analysis and mitigation

A Machine-in-the-Middle (MitM) vulnerability was discovered in the https-proxy-agent npm package affecting versions prior to 2.2.3. The vulnerability was disclosed on September 25, 2019, and published to the GitHub Advisory Database on April 16, 2020. The issue was assigned the identifier GHSA-pc5p-h8pf-mvwp and received a moderate severity rating with a CVSS score of 6.1 (GitHub Advisory, Snyk Report).

The vulnerability occurs when the https-proxy-agent package fails to enforce TLS on the socket if the proxy server responds to the request with an HTTP status code different than 200. When targeting an HTTP proxy, the package opens a socket to the proxy and sends a CONNECT request. If the proxy server responds with a non-200 status code, the package incorrectly returns the socket without performing a TLS upgrade (Snyk Report). The vulnerability is classified as CWE-300 and has been assigned a CVSS v3.1 base score of 6.1, with metrics indicating adjacent attack vector, high attack complexity, no privileges required, and no user interaction needed (GitHub Advisory).

The vulnerability allows an attacker with access to the proxy server to intercept unencrypted communications. This could result in the exposure of sensitive information, including basic authentication credentials or other secrets that would normally be protected by TLS encryption. The impact is particularly severe as it affects the confidentiality of the data, potentially leading to unauthorized access to restricted information (GitHub Advisory, Snyk Report).

The vulnerability has a proof-of-concept exploit available, as confirmed by Snyk's Security Team. The attack requires the attacker to be in a position to intercept the proxy server communications, and while it doesn't require user interaction or special privileges, it does have high attack complexity (Snyk Report).

Users are recommended to upgrade to version 2.2.3 or higher of the https-proxy-agent package to address this vulnerability. The fix was implemented by using an EventEmitter to replay failed proxy connect HTTP requests, preventing the exposure of sensitive data to the proxy server (GitHub Commit, GitHub Advisory).