Executive brief
steroids is a development framework for building mobile applications. The package insecurely downloads executable files over unencrypted HTTP connections. An attacker on the network path (such as a compromised ISP or WiFi network) can intercept and replace the downloaded executable with malicious code, gaining complete control of the developer's system and any applications built with the framework.
Technical details
The vulnerability stems from insecure resource download practices (CWE-311: Missing Encryption of Sensitive Data) in the steroids framework. The package downloads executables over unencrypted HTTP connections rather than HTTPS, making the downloads vulnerable to man-in-the-middle (MITM) attacks. An attacker with a privileged network position (adjacent network access or network path control) can intercept the HTTP response and replace the legitimate executable with malicious code, leading to arbitrary code execution on the developer's machine. No patch was issued for this vulnerability; the package is now marked as deprecated since 2022, and the original GitHub repository is no longer accessible. Users are advised to migrate to actively maintained alternatives such as native PhoneGap APIs.
Affected products
- AppGyver steroids up to 4.1.27
Timeline
- 2016: disclosed: Vulnerability discovered and reported
- 2018-03: other: No patch issued as of March 2018
- 2022-08: other: Package marked as deprecated; GitHub repository no longer publicly available
- 2019-02-18: advisory: GitHub Security Advisory published