Executive brief
cobalt-cli is a command-line tool that downloads executable code over unencrypted HTTP connections. An attacker positioned on the network path can intercept these downloads and replace the legitimate executable with malicious code, leading to arbitrary code execution on the user's system.
Technical details
The vulnerability is an insecure download (CWE-311: missing encryption) combined with improper privilege management (CWE-269). cobalt-cli fetches an executable resource over HTTP instead of HTTPS, making it vulnerable to man-in-the-middle (MITM) attacks. An attacker with network access (on a shared network, ISP level, or at a network choke point) can intercept the HTTP response and substitute a malicious binary. The vulnerability affects all versions up to and including 2.5.8, with no patch currently available. Exploitation requires the attacker to have privileged network position between the target system and the download server.
Affected products
- cobalt-cli cobalt-cli <=2.5.8
Timeline
- 2019-02-18: disclosed: Vulnerability published to GitHub Advisory Database
- 2020-06-16: other: GitHub security review completed