Executive brief
unicode-json is a JavaScript library that downloads data files over unencrypted HTTP instead of HTTPS. An attacker positioned on the network path can intercept and modify these downloads, potentially injecting malicious code or stealing sensitive data that the application relies on.
Technical details
The vulnerability is a missing encryption / insecure transport issue (CWE-311) in which unicode-json retrieves required resources over HTTP instead of HTTPS. An attacker with network-level access (e.g., on a shared WiFi network, compromised router, or ISP position) can perform man-in-the-middle attacks to intercept and modify downloaded resources without the client's knowledge. Depending on how the library uses the downloaded data, impact ranges from reading sensitive information to achieving remote code execution. No authentication or user interaction is required; the attack occurs passively during normal library operation. The vulnerability was fixed in version 2.0.0 by switching to HTTPS downloads.
Affected products
- npm unicode-json < 2.0.0
Timeline
- 2019-02-18: disclosed
- 2.0.0: patched: Version 2.0.0 or greater contains fix