Executive brief
embedza is a Node.js library that embeds rich media content into web applications. The library downloads executable resources over unencrypted HTTP connections, allowing attackers positioned on the network path to intercept and replace downloads with malicious code, leading to arbitrary code execution on systems using the library.
Technical details
embedza downloads executables over unencrypted HTTP connections (CWE-311: Missing Encryption of Sensitive Data). An attacker with a privileged network position (man-in-the-middle capability) can intercept the HTTP response and replace the legitimate executable with a malicious one, resulting in arbitrary code execution on the host system. The vulnerability affects all versions prior to 1.2.4. The fix involves updating to version 1.2.4 or later, which presumably switches to secure HTTPS downloads.
Affected products
- npm embedza < 1.2.4
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: Version 1.2.4 and later