Executive brief
dalek-browser-chrome-canary is a Node.js package for automated browser testing that downloads a Chrome executable as part of its setup. The package insecurely downloads this executable over unencrypted HTTP, allowing an attacker with network access to intercept and replace it with malicious code, gaining complete control of the affected system.
Technical details
This vulnerability exists in dalek-browser-chrome-canary's installation routine, which downloads a Chrome browser executable over an unencrypted HTTP connection rather than HTTPS (CWE-311: Missing Encryption of Sensitive Data). An attacker with network-level access (e.g., on a public WiFi network or via ISP compromise) can perform a man-in-the-middle (MITM) attack to intercept the download response and serve a malicious executable. When the package is executed, the compromised binary runs with the privileges of the user installing or running the package, resulting in arbitrary code execution. No patch has been released for this vulnerability; the recommended mitigation is to avoid using this package entirely or to prevent installation on untrusted networks.
Affected products
- Node.js dalek-browser-chrome-canary <= 0.0.10-2014-03-24-17-36-27
Timeline
- 2019-02-18: disclosed
- 2020-06-16: advisory: GitHub reviewed