Executive brief
The selenium-download library, used to automate the setup of browser testing tools, downloads essential software components over insecure connections. An attacker positioned on the same network could intercept these downloads and replace them with malicious software. This could allow an attacker to gain full control over the developer or server machine running the tool.
Technical details
The selenium-download npm package (versions prior to 2.0.7) retrieves the Selenium standalone server and Chromedriver binaries via unencrypted HTTP. This lack of transport layer security (CWE-311) allows a network-adjacent or man-in-the-middle attacker to intercept the traffic and perform a binary replacement. Because the downloaded files are executables intended to be run on the host system, this results in arbitrary remote code execution (RCE). The vulnerability is resolved in version 2.0.7 by switching to HTTPS for all resource downloads.
Affected products
- Groupon selenium-download < 2.0.7
Timeline
- 2016-10-05: disclosed: Initial discovery/reporting via Node Security Services
- 2018-05-29: advisory: NVD publication date
- 2019-02-18: advisory: GitHub Advisory Database publication date