Executive brief
libxl is a Node.js binding library for working with Excel files. The library downloads an executable dependency over an unencrypted HTTP connection during installation. An attacker positioned to intercept network traffic could replace the legitimate executable with a malicious one, gaining code execution on any system that installs or updates the library.
Technical details
The vulnerability is an insecure download issue (CWE-269, CWE-311) where libxl retrieves an executable dependency over unencrypted HTTP rather than HTTPS. The root cause is improper use of insecure transport during the automated SDK download process. An attacker on the network path (adjacent network position, man-in-the-middle) can intercept the HTTP response and substitute a malicious executable without the user's knowledge. Successful exploitation results in arbitrary code execution with the privileges of the installing user. The module author recommends using a pinned and verified version of the SDK instead of relying on automated downloads.
Affected products
- DirtyHairy libxl 0.4.5 and earlier
Timeline
- 2019-02-18: disclosed
- 2016: other: CVE-2016-10585 assigned