Executive brief
macaca-chromedriver is a testing tool that automates web browser interactions for quality assurance. The tool insecurely downloads an executable over unencrypted HTTP, allowing an attacker positioned on the network to intercept and replace it with malware, leading to immediate code execution with the privileges of the user running the tool.
Technical details
The vulnerability is a missing encryption issue (CWE-311) in macaca-chromedriver's executable download mechanism. The tool downloads a required executable over HTTP instead of HTTPS, making it vulnerable to man-in-the-middle (MITM) attacks. An attacker with network access between the target system and the download source can intercept the HTTP response and inject malicious executable code. This requires the attacker to have a privileged network position (e.g., on the same network, controlling a router, or performing DNS spoofing), but no authentication or user interaction beyond normal tool usage is needed. Successful exploitation results in arbitrary code execution. The vulnerability is fixed in version 1.0.29 and later.
Affected products
- macaca macaca-chromedriver <1.0.29
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: Fix available in version 1.0.29