Executive brief
arrayfire-js is a Node.js library used for high-performance computing. The library incorrectly downloads necessary software components over an unencrypted connection. This allows an attacker on the same network to intercept the download and replace it with malicious code, potentially leading to a full takeover of the system where the library is installed.
Technical details
The arrayfire-js package for Node.js is vulnerable to a Man-in-the-Middle (MitM) attack because it retrieves binary executables and resources via unencrypted HTTP instead of HTTPS. An attacker with a privileged network position (such as on a public Wi-Fi or a compromised local network) can intercept the cleartext traffic and inject a malicious payload in place of the legitimate binary. This results in Remote Code Execution (RCE) upon installation or execution of the library. As of the latest advisory, no patch is available, and users are advised to avoid the package or ensure installations occur only on trusted, secure networks.
Affected products
- ArrayFire arrayfire-js <= 0.21.4
Timeline
- 2016-10-09: disclosed: Vulnerability identified via HackerOne
- 2018-06-01: advisory: NVD published CVE-2016-10598
- 2019-02-18: advisory: GitHub Advisory published