Executive brief
Haxe, a programming language compiler and toolkit, insecurely downloads executable resources over unencrypted HTTP connections. An attacker positioned on the network path between a developer's machine and the download source could intercept and replace the executable with malicious code, gaining full control over the system during the build or installation process.
Technical details
The vulnerability exists in affected versions of Haxe (prior to 5.0.10) which download executables or critical resources over plain HTTP rather than HTTPS. This is a CWE-269 (Improper Access Control) and CWE-311 (Missing Encryption of Sensitive Data) issue. An attacker with network access (e.g., on the same WiFi, or via BGP hijacking) can perform a man-in-the-middle attack to intercept the HTTP response and inject a malicious executable. No authentication or user interaction beyond running the normal installation/build process is required. The attack results in arbitrary code execution with the privileges of the user running Haxe. The fix is to update to version 5.0.10 or later.
Affected products
- Haxe Foundation Haxe prior to 5.0.10
Timeline
- 2019-02-18: disclosed
- 2016: other: CVE-2016-10602 assigned