Executive brief
jdf-sass is a Node.js-based SASS compilation tool that downloads executable resources over unencrypted HTTP. An attacker with network access between the user and the download server could intercept and replace the executable with malicious code, resulting in complete system compromise on the machine running the package.
Technical details
jdf-sass downloads executables over HTTP without encryption or signature verification, exposing the download to man-in-the-middle attacks (CWE-311: Missing Encryption). An attacker positioned on the network path between the client and server can intercept the HTTP response and serve a malicious executable instead. The vulnerability requires network-level access (privileged network position) but no authentication or user interaction. An attacker can achieve arbitrary code execution with the privileges of the user running jdf-sass. No patch has been released; the advisory recommends avoiding the package entirely or restricting its use to trusted private networks.
Affected products
- npm jdf-sass ≤1.0.18
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2020-06-16: other: GitHub advisory reviewed