Executive brief
dalek-browser-ie is a Node.js test automation tool that downloads executables over unencrypted HTTP. An attacker with network access (such as on a public Wi-Fi network or compromised ISP) can intercept and replace the downloaded executable with malicious code, gaining full control of the machine running the tool.
Technical details
dalek-browser-ie downloads executable resources over unencrypted HTTP without integrity validation (CWE-311: Missing Encryption of Sensitive Data). An attacker positioned on the network path (man-in-the-middle) can intercept the HTTP response and inject a malicious executable. The vulnerability affects all versions up to and including 0.0.5. Exploitation requires network-level access but no user interaction or privileges. The package author has marked it deprecated and no patch is available; the recommended mitigation is to discontinue use of the package.
Affected products
- dalek dalek-browser-ie <=0.0.5
Timeline
- 2019-02-18: disclosed