Executive brief
dalek-browser-chrome is a testing automation library that insecurely downloads browser executables over unencrypted HTTP instead of HTTPS. An attacker positioned on the network path (such as a compromised router or ISP) can intercept and replace the downloaded executable with malicious code, gaining full control of the system running the tool.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where dalek-browser-chrome downloads executable resources over unencrypted HTTP. An attacker with a network-adjacent or privileged network position can perform a man-in-the-middle attack to intercept the HTTP response and inject a malicious executable, achieving arbitrary code execution on the affected system. No authentication or user interaction is required; the attack succeeds whenever the package downloads resources. No patch has been released; the maintainers recommend discontinuing use of the package in favor of alternatives like TestCafé.
Affected products
- <UNKNOWN> dalek-browser-chrome <=0.0.11
Timeline
- 2019-02-18: disclosed
- other: CVE-2016-10604 assigned