Executive brief
nodewebkit is a framework for building desktop applications. This vulnerability allows an attacker positioned on the network to intercept downloads and inject malicious executables, leading to arbitrary code execution on affected systems. The package is deprecated and no patch is available.
Technical details
The vulnerability is a lack of encryption (CWE-311) in the download mechanism used by nodewebkit. The affected versions download executables over unencrypted HTTP instead of HTTPS, allowing man-in-the-middle (MITM) attacks by an attacker with network access. Attack requires network positioning but no user interaction or authentication. An attacker can intercept the HTTP response and replace the executable with malicious code, achieving remote code execution. No patch has been released; the package is deprecated and users should migrate to the official installer.
Affected products
- nodewebkit nodewebkit <= 0.11.6
Timeline
- 2019-02-18: disclosed
- 2020-06-16: advisory: GitHub reviewed