Description
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Recommendation
Update the xmlhttprequest-ssl package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.6.1
- Patched version(s): 1.6.1
References
Could your website be exposed too?
SmartScanner can check your website for Improper Certificate Validation in xmlhttprequest-ssl and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper Input Validation in is-email - CVE-2021-36716
- Improper Input Validation in sanitize-html - sanitize-html - CVE-2021-26540
- xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - CVE-2020-28502
- Improper Input Validation in sanitize-html - CVE-2021-26539
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023