Executive brief
galenframework-cli is a Node.js testing framework tool that downloads executables during installation. Affected versions download these executables over unencrypted HTTP, allowing attackers on the network path to intercept and replace the executable with malicious code, leading to immediate code execution on the user's system.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where galenframework-cli downloads executable resources over an unencrypted HTTP connection rather than HTTPS. An attacker positioned on the network path between the client and server can intercept the HTTP response and perform a man-in-the-middle attack to replace the legitimate executable with a malicious one. This requires network adjacency (e.g., shared network, compromised router, or ISP-level access) but no authentication. Upon execution of the downloaded malicious executable, arbitrary code runs with the privileges of the user running galenframework-cli. The vulnerability was fixed in version 2.3.1 by switching to secure HTTPS downloads.
Affected products
- galenframework galenframework-cli before 2.3.1
Timeline
- 2019-02-18: disclosed
- 2016: patched: CVE-2016-10560 indicates 2016 origin; fix released in version 2.3.1