Executive brief
install-nw is a Node.js package that downloads NW.js executables during installation. The package downloads these executables over unencrypted HTTP rather than secure HTTPS, allowing an attacker positioned on the network to intercept and replace the executable with malicious code, leading to arbitrary code execution on the developer's machine during package installation.
Technical details
install-nw suffers from CWE-311 (Missing Encryption of Sensitive Data) by downloading NW.js executables over unencrypted HTTP connections. An attacker with network access or a privileged network position (such as control of a proxy, router, or ISP on the attack path) can perform a man-in-the-middle (MITM) attack to intercept the HTTP response and inject a malicious executable. The attack requires network positioning but no authentication or user interaction beyond a standard npm install. Successful exploitation grants arbitrary code execution with the privileges of the user running npm. The vulnerability was fixed in version 1.1.5 by switching to secure HTTPS downloads.
Affected products
- npm install-nw before 1.1.5
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: fix available in version 1.1.5