Executive brief
pngcrush-installer is a Node.js package that downloads an executable binary during installation. The package downloads this executable over an unencrypted HTTP connection, allowing an attacker on the network to intercept and replace it with malicious code. This results in arbitrary code execution on any system that installs or updates the package.
Technical details
The vulnerability is a missing encryption of sensitive data (CWE-311) where pngcrush-installer downloads an executable resource over unencrypted HTTP. An attacker in a privileged network position (man-in-the-middle) can intercept the HTTP response and substitute the legitimate executable with a malicious binary, leading to code execution with the privileges of the installing user. No user interaction is required—exploitation occurs automatically during package installation. The vulnerability affects all versions prior to 1.8.10, which fixed the issue by using HTTPS for downloads.
Affected products
- npm pngcrush-installer < 1.8.10
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: Fixed in version 1.8.10