Executive brief
selenium-binaries is a Node.js package that downloads Selenium WebDriver executables needed to automate web browser testing. Versions prior to 0.15.0 download these critical executables over unencrypted HTTP connections. An attacker positioned on the network path (such as on a corporate network or shared Wi-Fi) could intercept and replace the executable with malware, achieving complete code execution on the developer's or test system.
Technical details
The vulnerability is a cleartext protocol download issue (CWE-311) where selenium-binaries fetches browser driver executables over HTTP instead of HTTPS. The attack requires a privileged network position (man-in-the-middle capability) but no authentication or user interaction. An attacker can intercept the HTTP response and serve a malicious executable, leading to arbitrary code execution with the privileges of the process running selenium-binaries. The vulnerability affects all versions before 0.15.0, which was released with a fix to use HTTPS. The fix is available in the official repository and users are advised to upgrade or switch to the official selenium-webdriver package.
Affected products
- npm selenium-binaries before 0.15.0
Timeline
- 2019-02-18: disclosed
- 2020-09-22: patched: fix merged into master branch as version 0.15.0