Executive brief
product-monitor is a Node.js monitoring library that downloads executable resources over unencrypted HTTP. An attacker positioned on the network path can intercept and replace these downloads with malicious executables, achieving arbitrary code execution on systems running the application.
Technical details
The vulnerability is a missing encryption/cleartext transmission issue (CWE-311) in which product-monitor downloads an executable resource over HTTP instead of HTTPS. An attacker with network access between the application and the remote server can perform a man-in-the-middle attack to intercept the HTTP response and replace the legitimate executable with a malicious payload. This requires a privileged network position (e.g., on the same LAN, controlling a router, or operating a compromised proxy) but does not require authentication or user interaction from the application user. The vulnerability is fixed in version 2.2.5 and later.
Affected products
- npm product-monitor < 2.2.5
Timeline
- 2019-02-18: disclosed