Executive brief
webrtc-native is a Node.js library for WebRTC communication that downloads executable components insecurely over unencrypted HTTP. An attacker positioned to intercept network traffic can replace the downloaded executable with malicious code, gaining full code execution on any system using the library.
Technical details
The vulnerability exists in webrtc-native's download mechanism for native components, which retrieves executables over plain HTTP rather than HTTPS. This is a missing encryption issue (CWE-311). An attacker with a privileged network position (e.g., on the same network or controlling routing) can perform a man-in-the-middle attack to intercept and replace the binary with a malicious payload, leading to arbitrary code execution during module initialization. No patch has been released; the only mitigation is building native components from source rather than downloading precompiled binaries.
Affected products
- npm webrtc-native all versions up to and including 1.4.0
Timeline
- 2019-02-18: disclosed