Executive brief
bkjs-wand is a Node.js library that downloads executable code to run on the system. The library downloads this code over an unencrypted HTTP connection, allowing attackers on the network path to intercept and replace the executable with malicious code. An attacker with network access (such as on a shared Wi-Fi network or compromised router) can execute arbitrary code on systems using this library.
Technical details
The vulnerability is a cleartext download issue (CWE-311: Missing Encryption of Sensitive Data) where bkjs-wand fetches an executable via HTTP rather than HTTPS. The attack requires a network-privileged position (man-in-the-middle capability) such as control of a router, local network access, or DNS hijacking—no authentication or user interaction is required beyond normal library operation. An attacker can intercept the HTTP response and deliver a malicious binary, resulting in arbitrary code execution with the privileges of the application using bkjs-wand. The vulnerability was fixed in version 0.3.2; versions prior to 0.3.2 are affected.
Affected products
- bkjs-wand bkjs-wand < 0.3.2
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: patched: Fix released in version 0.3.2