Executive brief
jser-stat is a JavaScript statistics package that downloads configuration resources over unencrypted HTTP instead of HTTPS. An attacker on the same network or with access to network infrastructure can intercept these downloads and modify or read the data, potentially leading to code execution or data theft. This risk is highest on public or untrusted networks.
Technical details
The vulnerability involves insecure HTTP downloads in jser-stat (CWE-311: Missing Encryption of Sensitive Data). The package downloads JSON configuration files from jser.info over unencrypted HTTP, making them vulnerable to man-in-the-middle (MITM) attacks. An attacker with a privileged network position (on the same network, controlling network infrastructure, or with ISP-level access) can intercept and modify these resources at will. The impact ranges from data exposure to remote code execution, depending on how the downloaded resources are processed by the application. No patch is available; the primary mitigation is to avoid using this package or ensure it is not used on public networks.
Affected products
- jser jser-stat up to 4.0.3
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database