Critical SSL Certificate Validation Bypass in node-xmlhttprequest-ssl Package
Summary
UBUNTU-CVE-2021-31597: The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.re... Affects node-xmlhttprequest-ssl versions 1.6.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-xmlhttprequest-ssl package is a Node.js library that facilitates making HTTP requests with SSL support. It is commonly used in applications that require secure communication over the internet. However, prior to version 1.6.1, this package had a significant vulnerability that disabled SSL certificate validation by default, exposing applications to potential man-in-the-middle attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-31597, arises from the way the xmlhttprequest-ssl package handles SSL certificate validation. In versions before 1.6.1, the rejectUnauthorized property is treated as false when it is undefined, leading to a scenario where no SSL certificates are rejected. This flaw can allow attackers to intercept and manipulate data transmitted between the client and server, posing a severe security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can explicitly set the rejectUnauthorized property to true in your HTTPS requests. For example:
const https = require('https');
const options = { hostname: 'example.com', port: 443, path: '/', method: 'GET', rejectUnauthorized: true };
const req =
https.
request(options, (res) => { /* handle response */ });
req.end(); However, this is not a substitute for updating the package.
Conclusion
The node-xmlhttprequest-ssl package has a critical vulnerability that disables SSL certificate validation by default, exposing applications to significant security risks. It is crucial to update to version 1.6.1 or later to mitigate these risks effectively.
See every vulnerability recorded for node-xmlhttprequest-ssl →
FAQ
CVE-2021-31597 is a vulnerability in the node-xmlhttprequest-ssl package that allows SSL certificate validation to be bypassed, potentially exposing applications to security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary consequence is the risk of man-in-the-middle attacks, where an attacker can intercept and manipulate data between the client and server.
Yes, the patch is available in version 1.6.1 of the node-xmlhttprequest-ssl package. Updating to this version will resolve the vulnerability.
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
