Executive brief
webdrvr is a Node.js package that downloads executable files over unencrypted HTTP connections. An attacker with network access can intercept these downloads and inject malicious code, achieving arbitrary code execution on systems running the package.
Technical details
webdrvr downloads executable resources over unencrypted HTTP instead of HTTPS, creating a classic man-in-the-middle attack vector (CWE-311: Missing Encryption of Sensitive Data). An attacker positioned on the network path—such as on a public WiFi network, compromised network infrastructure, or with ISP-level access—can intercept the HTTP response and replace the executable with a malicious binary. This results in immediate code execution in the context of the user running webdrvr. No patch has been released; mitigation requires discontinuing use of the package or restricting its use to isolated private networks only.
Affected products
- webdrvr webdrvr ≤2.43.0-1
Timeline
- 2019-02-18: disclosed