JavaScript Injection Vulnerability in Pacparser Package
Summary
DEBIAN-CVE-2023-37360: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products). Affects pacparser versions < 1.4.3-1. Fixed in 1.4.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacparser is a library used for parsing proxy auto-configuration (PAC) files, which are scripts that help web browsers automatically select the appropriate proxy server for fetching resources. It is commonly utilized in enterprise environments to manage network traffic and enhance security. However, prior versions of Pacparser are susceptible to a vulnerability that allows for JavaScript injection, potentially leading to privilege escalation.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-37360 affects versions of Pacparser prior to 1.4.2. It arises from the function pacparser_find_proxy, which does not adequately sanitize input URLs. An attacker controlling the URL can inject malicious JavaScript code, which may be executed in the context of the user's browser, leading to unauthorized actions and potential privilege escalation. This vulnerability poses significant risks, especially in enterprise security products where PAC files are commonly used.
How To Fix
Minimum fixed version
1.4.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pacparserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that PAC files are sourced from trusted locations and implement strict input validation to mitigate the risk of JavaScript injection until the package can be updated.
Conclusion
The vulnerability in the Pacparser package poses significant risks due to its potential for JavaScript injection and privilege escalation. Users are strongly advised to update to the latest version to mitigate these risks. Temporary workarounds can be implemented while awaiting updates.
See every vulnerability recorded for pacparser →
FAQ
The vulnerability allows for JavaScript injection through unvalidated URLs, which can lead to privilege escalation.
Versions prior to 1.4.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement strict input validation and ensure PAC files are sourced from trusted locations as a temporary workaround.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-37360.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for pacparser.
