ProxyAgent TLS Option Bypass via SOCKS5 Proxy

Executive Summary

This vulnerability occurs in undici's ProxyAgent when it is configured to use a SOCKS5 proxy URI (socks5:// or socks://). The ProxyAgent silently drops the requestTls option, which means that the HTTPS connection through the SOCKS5 tunnel does not use the user-configured TLS settings such as custom certificate authorities (CA), certificates, keys, or servername verification.

As a result, instead of using the intended internal or corporate CA for certificate pinning, the connection falls back to Node's default trust store (Mozilla CA bundle). This causes the application to accept any certificate signed by any publicly-trusted CA for the target hostname, breaking the intended security pin and enabling man-in-the-middle (MITM) attacks where attackers can read and tamper with HTTPS traffic.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows man-in-the-middle (MITM) attacks by bypassing TLS certificate validation when using a SOCKS5 proxy with undici's ProxyAgent. As a result, HTTPS traffic can be intercepted and tampered with, breaking the intended TLS pinning and trust restrictions.

Such interception and tampering of HTTPS traffic can lead to unauthorized access to sensitive data, which may violate data protection requirements in common standards and regulations like GDPR and HIPAA that mandate the protection of data in transit.

Therefore, applications affected by this vulnerability risk non-compliance with these regulations due to compromised confidentiality and integrity of transmitted data.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a serious security risk where HTTPS connections that are supposed to be restricted to trusted internal or corporate certificate authorities instead accept any publicly-trusted certificate. This breaks certificate pinning and allows attackers to perform man-in-the-middle (MITM) attacks.

• Attackers can intercept and read sensitive HTTPS traffic.
• Attackers can tamper with the data exchanged over HTTPS.
• Confidentiality and integrity of the HTTPS communication are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade undici to version 7.28.0 or 8.5.0, where the issue is fixed.

If upgrading is not immediately possible, route the traffic through an HTTP-proxy ProxyAgent instead of a SOCKS5 proxy, as the HTTP-proxy ProxyAgent honors the requestTls option correctly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when undici's ProxyAgent is configured with a SOCKS5 proxy URI (socks5:// or socks://) and silently drops the requestTls option, causing HTTPS connections to fall back to Node's default trust store instead of using user-configured TLS settings.

To detect if your system or network is affected, you should check if your application uses undici versions between 7.23.0 and 7.28.0 (inclusive) or 8.0.0 to 8.5.0 (inclusive) with a SOCKS5 proxy configuration.

You can verify the undici version installed by running the following command in your project directory:

• npm list undici

To check if your application is using a SOCKS5 proxy URI with undici's ProxyAgent, review your application's proxy configuration files or environment variables for URIs starting with socks5:// or socks://.

Additionally, you can monitor network traffic to detect if HTTPS connections are being routed through a SOCKS5 proxy by inspecting proxy settings or network logs.

Since the vulnerability involves TLS certificate validation bypass, you might also detect unexpected certificates accepted by your application when connecting through the SOCKS5 proxy, which can be checked by enabling verbose TLS logging or debugging in your Node.js application.

Useful 0 Not Useful 0