Executive brief
KindleGen is a tool used to convert documents into e-book formats for Amazon Kindle. The application insecurely downloads an executable component over an unencrypted HTTP connection, allowing attackers positioned on the network path to intercept and replace the executable with malicious code, leading to arbitrary code execution on the user's system.
Technical details
This vulnerability arises from insecure transmission of an executable over unencrypted HTTP (CWE-311: Missing Encryption of Sensitive Data). An attacker with a privileged network position (man-in-the-middle) can intercept the HTTP response and inject a malicious executable in place of the legitimate one. The attack requires network access between the target system and the remote server but no authentication or user interaction beyond normal KindleGen operation. Successful exploitation results in arbitrary code execution with the privileges of the KindleGen process. The vulnerability was fixed in version 1.1.0 and later.
Affected products
- Amazon KindleGen all versions before 1.1.0
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: patched: Fixed in version 1.1.0