Executive brief
iedriver is a Node.js library for automating Internet Explorer browser control. Affected versions download executable resources over unencrypted HTTP, allowing an attacker with network access to intercept and replace the executable with malicious code, leading to remote code execution on systems using the library.
Technical details
iedriver contains a missing encryption vulnerability (CWE-311) where executable resources are downloaded over HTTP instead of HTTPS. An attacker positioned on the network path (e.g., via compromised WiFi, BGP hijacking, or ARP spoofing) can intercept the HTTP response and substitute a malicious executable before it reaches the client. No authentication or user interaction is required; the attack triggers automatically when iedriver attempts to download resources. The vulnerability affects all versions prior to 3.0.0, which introduced HTTPS for resource downloads.
Affected products
- npm iedriver <3.0.0
Timeline
- 2019-02-18: disclosed: Advisory published to GitHub Advisory Database
- 2019-02-18: patched: Fix available in version 3.0.0