Executive brief
geoip-lite-country is a Node.js library that provides geolocation data based on IP addresses. The package downloads essential data files over unencrypted HTTP instead of HTTPS, allowing attackers positioned on the network path to intercept, read, or modify these resources. This could enable data theft, service disruption, or malicious code injection.
Technical details
The vulnerability is a missing encryption issue (CWE-311) in which geoip-lite-country retrieves geolocation database resources over insecure HTTP. An attacker with network-level access (man-in-the-middle position) can intercept and modify the downloaded resources without detection. The attack requires no authentication or user interaction; it is passive interception of outbound HTTP traffic from systems running affected versions. Depending on the content and usage of the modified resources, impact ranges from information disclosure to remote code execution. The vulnerability was fixed in version 1.1.4.
Affected products
- npm geoip-lite-country before 1.1.4
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2019-02-18: patched: Fix available in version 1.1.4 or later