Pac-resolver NPM pob, uas muaj ntau dua 3 lab rub tawm hauv ib lub lis piam, muaj qhov tsis zoo (CVE-2021-23406) uas tso cai rau nws cov cai JavaScript kom ua tiav hauv cov ntsiab lus ntawm daim ntawv thov thaum xa HTTP thov los ntawm Node.js cov haujlwm uas txhawb lub npe neeg rau zaub mov auto-configuration muaj nuj nqi.
Pac-resolver pob parses PAC cov ntaub ntawv uas suav nrog cov ntawv sau npe tsis siv neeg. Cov ntaub ntawv PAC muaj cov lej JavaScript tsis tu ncua nrog FindProxyForURL muaj nuj nqi uas txhais cov logic rau xaiv tus npe nyob ntawm tus tswv tsev thiab qhov thov URL. Lub ntsiab lus ntawm qhov tsis zoo yog tias txhawm rau ua kom tiav JavaScript code hauv pac-resolver, VM API muab hauv Node.js tau siv, uas tso cai rau koj los ua kom tiav JavaScript code hauv cov ntsiab lus sib txawv ntawm V8 lub cav.
Cov API uas tau teev tseg tau raug cim meej meej hauv cov ntaub ntawv uas tsis tau npaj rau kev khiav haujlwm tsis muaj kev ntseeg siab, vim nws tsis muab kev sib cais tag nrho ntawm cov cai uas tau khiav thiab tso cai nkag mus rau cov ntsiab lus qub. Qhov teeb meem tau raug daws nyob rau hauv pac-resolver 5.0.0, uas tau raug tsiv mus siv lub tsev qiv ntawv vm2, uas muab cov qib siab dua ntawm kev sib cais tsim nyog rau kev khiav cov cai tsis ntseeg.
Thaum siv cov txheej txheem yooj yim ntawm pac-resolver, tus neeg tawm tsam los ntawm kev sib kis ntawm cov ntaub ntawv tsim tshwj xeeb PAC tuaj yeem ua tiav nws txoj cai JavaScript hauv cov ntsiab lus ntawm cov cai ntawm qhov project siv Node.js, yog tias qhov project no siv cov tsev qiv ntawv uas muaj kev vam khom. nrog pac-resolver. Qhov nrov tshaj plaws ntawm cov tsev qiv ntawv muaj teeb meem yog Proxy-Agent, teev raws li kev vam khom ntawm 360 cov haujlwm, suav nrog urlib, aws-cdk, mailgun.js thiab firebase-tools, tag nrho ntau dua peb lab rub tawm ib lub lis piam.
Yog tias daim ntawv thov uas muaj kev vam khom ntawm pac-resolver loads PAC cov ntaub ntawv muab los ntawm lub kaw lus uas txhawb WPAD npe tsis siv neeg teeb tsa raws tu qauv, ces cov neeg tawm tsam nrog kev nkag mus rau hauv lub network tuaj yeem siv qhov kev faib tawm npe ntawm DHCP los ntxig cov ntaub ntawv PAC siab phem.
Tau qhov twg los: opennet.ru