Executive brief
The closure-util library, used for managing Google Closure Library projects, downloads necessary software components over insecure HTTP connections. An attacker positioned on the same network could intercept these downloads and replace them with malicious software. This could allow the attacker to take full control of the developer's machine or build server.
Technical details
The closure-util package insecurely fetches executable resources (specifically the compiler and library binaries) using unencrypted HTTP instead of HTTPS. This vulnerability (CWE-311/CWE-310) allows a network-positioned attacker to perform a Man-in-the-Middle (MitM) attack. By intercepting the cleartext traffic, the attacker can swap the legitimate binary with a malicious payload. When the system executes the downloaded file, it results in arbitrary code execution. While no official patch is noted, users can mitigate the risk by manually updating the 'compiler_url' and 'library_url' fields in the 'default-config.json' file to use HTTPS.
Affected products
- OpenLayers closure-util <= 2.0.0-beta.1
Timeline
- 2016-10-24: disclosed: Original disclosure via Node Security Services
- 2018-06-01: advisory: NVD published CVE-2016-10583
- 2019-02-18: advisory: GitHub Advisory published GHSA-2hpj-g53m-9gj6