JavaScript Injection Vulnerability in Pacparser Package
Summary
CVE-2023-37360: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products). Affects pacparser versions < 0bf0636de624996fe202b51eec8a58abd774269e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacparser is an open-source library used for parsing Proxy Auto-Configuration (PAC) files, which are scripts that help web browsers determine whether to send web traffic directly or through a proxy server. The library is widely utilized in various applications and enterprise security products to manage network traffic efficiently. However, a vulnerability has been identified in versions prior to 1.4.2 that allows for JavaScript injection, potentially leading to privilege escalation if an attacker can control the URL.
Vulnerability Detail
The vulnerability, identified as CVE-2023-37360, arises from the function 'pacparser_find_proxy' in Pacparser versions before 1.4.2. This flaw allows attackers to inject malicious JavaScript into the PAC file, which can be exploited to escalate privileges within the application. The risk is particularly pronounced in enterprise environments where URLs may be controlled by malicious actors, leading to unauthorized access and manipulation of sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing strict input validation on URLs processed by the Pacparser to mitigate the risk of JavaScript injection. Additionally, restrict access to the PAC files to trusted sources only.
Conclusion
The CVE-2023-37360 vulnerability in the Pacparser package poses a significant risk due to its potential for JavaScript injection and privilege escalation. It is crucial for users of the library to update to the latest version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for pacparser →
FAQ
CVE-2023-37360 is a vulnerability in the Pacparser library that allows for JavaScript injection, potentially leading to privilege escalation.
Versions of Pacparser prior to 1.4.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
If you cannot upgrade immediately, implement strict input validation on URLs and restrict access to PAC files to trusted sources.
Related vulnerabilities
Recent vulnerabilities recorded for pacparser.
