Sephutheloana sa NPM sa pac-resolver, se jarollotsoeng ho feta limilione tse 3 ka beke, se na le ts'oaetso (CVE-2021-23406) e lumellang hore khoutu ea eona ea JavaScript e sebelisoe molemong oa ts'ebeliso ha e romella likopo tsa HTTP ho tsoa mererong ea Node.js ts'ehetsa ts'ebetso ea litlhophiso tsa li-auto-server tsa proxy.
Sephutheloana sa pac-resolver se arola lifaele tsa PAC tse kenyelletsang mongolo oa tlhophiso ea proxy ea othomathike. Faele ea PAC e na le khoutu ea kamehla ea JavaScript e nang le tšebetso ea FindProxyForURL e hlalosang mabaka a ho khetha moemeli ho latela moamoheli le URL e batloang. Taba ea bofokoli ke hore ho sebelisa khoutu ena ea JavaScript ho pac-resolver, VM API e fanoeng ho Node.js e ile ea sebelisoa, e u lumellang hore u sebelise khoutu ea JavaScript maemong a fapaneng a enjine ea V8.
API e boletsoeng e tšoailoe ka ho hlaka litokomaneng joalo ka ha e sa rereloa ho sebelisa khoutu e sa tšepahaleng, kaha ha e fane ka karohano e felletseng ea khoutu e tsamaisoang mme e lumella ho fihlella moelelo oa mantlha. Taba ena e rarollotsoe ho pac-resolver 5.0.0, e fetiselitsoeng ho sebelisa laebrari ea vm2, e fanang ka boemo bo phahameng ba ho itšehla thajana bo loketseng ho tsamaisa khoutu e sa tšepahaleng.
Ha a sebelisa mofuta o tlokotsing oa pac-resolver, mohlaseli ka phetisetso ea faele ea PAC e etselitsoeng ka ho khetheha a ka khona ho phethahatsa khoutu ea hae ea JavaScript ho latela khoutu ea projeke e sebelisang Node.js, haeba projeke ena e sebelisa lilaeborari tse nang le lits'epo. e nang le pac-resolver. Lilaebrari tse nang le bothata tse tsebahalang haholo ke Proxy-Agent, e thathamisitsoeng e le batho ba itšetlehileng ka merero e 360, ho kenyeletsoa urllib, aws-cdk, mailgun.js le firebase-tools, e etsang kakaretso ea download e fetang limilione tse tharo ka beke.
Haeba ts'ebeliso e itšetlehileng ka pac-resolver e laela faele ea PAC e fanoeng ke sistimi e ts'ehetsang WPAD proxy automatic configuration protocol, joale bahlaseli ba nang le phihlello ea marang-rang ea lehae ba ka sebelisa phepelo ea litlhophiso tsa moemeli ka DHCP ho kenya lifaele tsa PAC tse kotsi.
Source: opennet.ru