Executive brief
ibapi is a Node.js library that downloads executable resources over unencrypted HTTP. An attacker with network access (such as on a compromised or public Wi-Fi network) can intercept and replace the downloaded executable with malicious code, leading to arbitrary code execution on the system running ibapi.
Technical details
ibapi insecurely downloads executable resources over HTTP instead of HTTPS, creating a man-in-the-middle (MITM) vulnerability. The vulnerable component performs resource downloads without integrity verification or encrypted transport. The attack requires network-level access (adjacent network or ISP-level position) to intercept and modify the HTTP response. An attacker in such a position can replace the legitimate executable with malicious code, achieving remote code execution. No patch is currently available; the advisory recommends avoiding the package or limiting its use to private networks only.
Affected products
- npm ibapi up to 2.6.2
Timeline
- 2019-02-18: disclosed
- other: CVE-2016-10593 assigned