Executive brief
ezseed-transmission is a Node.js module that downloads and executes shell scripts for interacting with Transmission BitTorrent client. Versions 0.0.10 through 0.0.14 download critical scripts over unencrypted HTTP without certificate validation, allowing attackers on the same network (or at ISP level) to intercept and replace the script with malicious code, leading to complete system compromise.
Technical details
The vulnerability exists in ezseed-transmission's handling of script downloads, which uses unencrypted HTTP connections without SSL/TLS certificate validation (CWE-295, CWE-300). The module downloads a jq binary from http://stedolan.github.io/jq/download/linux64/jq and executes it without verification. An attacker positioned on an adjacent network or with ISP-level access can intercept the HTTP traffic and inject malicious code, achieving arbitrary code execution on the affected system. The attack requires network-level interception capability but no authentication or user interaction. The vulnerability was fixed in version 0.0.15 by switching to HTTPS with proper certificate validation.
Affected products
- ezseed ezseed-transmission 0.0.10 to 0.0.14
Timeline
- 2016-07-29: disclosed
- 2016-07-29: patched: Fix available in version 0.0.15