Executive brief
The operadriver package, used to automate the Opera web browser via Selenium, downloads necessary binary files over an unencrypted HTTP connection. This allows an attacker positioned on the same network to intercept the download and replace the legitimate driver with malicious software. If exploited, this could lead to full control over the system running the automation scripts.
Technical details
operadriver versions prior to 0.2.3 utilize insecure HTTP requests when fetching binary resources from remote servers. This lack of encryption (CWE-311) enables a Man-in-the-Middle (MITM) attacker to intercept the traffic and perform a file-swapping attack. By replacing the expected binary with a malicious payload, the attacker can achieve remote code execution (RCE) on the host machine. The attack requires the adversary to be positioned between the user and the remote server or on the same local network. The issue is resolved in version 0.2.3, which enforces secure download protocols.
Affected products
- cnpmjs operadriver < 0.2.3
Timeline
- 2016-10-05: disclosed: Vulnerability identified (based on CVE year)
- 2018-05-31: advisory: NVD published date
- 2019-02-18: advisory: GitHub Advisory published