Executive brief
chromedriver126 is a Node.js package used to automate Chrome browser testing and control. The package downloads executable files over unencrypted HTTP rather than HTTPS, allowing an attacker with network access to intercept and replace the executable with malicious code, leading to arbitrary code execution on systems running the tool.
Technical details
The vulnerability is a missing encryption of sensitive data (CWE-311) in the package download mechanism. chromedriver126 downloads executable resources over unencrypted HTTP connections rather than HTTPS. An attacker with a privileged network position (such as control of a shared WiFi network, ISP-level access, or compromised network infrastructure) can perform a man-in-the-middle attack to intercept the HTTP response and replace the executable with a malicious version. This results in arbitrary code execution with the privileges of the user running the chromedriver126 installation. No patch is available; the advisory recommends avoiding this package entirely or ensuring it is only installed on private networks.
Affected products
- npm chromedriver126 through 1.0.15
Timeline
- 2019-02-18: disclosed
- other: No patch is available for this vulnerability