Executive brief
Closure Compiler, a tool used to minimize and optimize JavaScript code, downloads executable resources over unencrypted HTTP connections instead of secure HTTPS. An attacker with network access can intercept and replace the downloaded executable with malicious code, achieving remote code execution on systems running the tool.
Technical details
This vulnerability results from insecure download over HTTP (CWE-311) of an executable resource during the build process. The attack vector is network-based and requires an attacker to have a privileged network position (man-in-the-middle capability) to intercept and modify the executable in transit. No authentication or user interaction is required; the exploit occurs when closurecompiler performs its normal initialization routine and downloads dependencies. An attacker can replace the legitimate executable with a malicious payload, resulting in arbitrary code execution with the privileges of the user running closurecompiler. The vulnerability was patched in version 1.6.1.
Affected products
- dcodeIO ClosureCompiler.js before 1.6.1
Timeline
- 2019-02-18: disclosed
- 2016: patched: Fix committed; version 1.6.1 or later contains the patch