Executive brief
wasdk is a WebAssembly SDK used by developers to build and deploy WebAssembly applications. The package insecurely downloads executable files over unencrypted HTTP, allowing attackers on the same network to intercept and replace the downloaded executable with malicious code, leading to arbitrary code execution on the developer's machine.
Technical details
wasdk downloads executable files over unencrypted HTTP connections, which is vulnerable to man-in-the-middle (MITM) attacks. The vulnerability manifests in CWE-311 (Missing Encryption of Sensitive Data). An attacker positioned on the network path between the victim and the download server can intercept the HTTP response and serve a malicious executable in its place. This requires network adjacency and the victim to be actively installing or updating the package, but requires no authentication or explicit user interaction beyond normal package installation. A successful attack results in arbitrary code execution with the privileges of the installing user. No patch has been released; the advisory recommends avoiding the package entirely or installing only on private, trusted networks.
Affected products
- wasdk wasdk <=1.0.54
Timeline
- 2019-02-18: disclosed
- 2016: other: CVE-2016-10587 assigned, but advisory published in 2019