Executive brief
The ipip Node.js library downloads resources over unencrypted HTTP instead of HTTPS. An attacker positioned to intercept network traffic can modify or steal these resources, potentially leading to reading sensitive data or injecting malicious code. The package is deprecated, and no patch is available.
Technical details
The vulnerability is an insecure resource download issue (CWE-311, CWE-269) where ipip retrieves external resources over HTTP without encryption. An attacker with network access or ISP-level privileges can perform man-in-the-middle (MITM) attacks to intercept, read, or modify the downloaded resources in transit. The attack requires a privileged network position (e.g., on a public WiFi network or with ISP-level access) but no authentication or user interaction. Depending on how the package uses these resources, exploitation could enable remote code execution. The package is marked deprecated with no patches available; the recommendation is to cease using it or only use it on isolated private networks.
Affected products
- ipip ipip All versions up to and including 3.0.0
Timeline
- 2019-02-18: disclosed: GHSA advisory published
- 2016: other: CVE-2016-10594 assigned