Executive brief
imageoptim is a Node.js package that compresses images by downloading and executing external compression tools. The package downloads these tools over unencrypted HTTP instead of HTTPS, allowing attackers on the network path to intercept and replace the downloads with malicious code, potentially achieving remote code execution when the tools are executed.
Technical details
imageoptim downloads compression algorithm resources (tarballs) over HTTP without encryption or integrity verification. An attacker positioned on the network or between the user and the remote server (man-in-the-middle) can intercept the download and substitute a malicious tarball, achieving remote code execution when the package extracts and uses the compromised tool. The vulnerability requires network-level access to the user or the connection to the resource server. No patch has been released; the advisory recommends not using this module.
Affected products
- npm imageoptim 0.5.0 and earlier
Timeline
- 2019-02-18: disclosed
- other: No fix currently available as of 2019-02-18