Executive brief
strider-sauce is a Node.js library used in continuous integration systems to download and execute tools. The library downloads executable files over unencrypted HTTP, allowing attackers positioned on the network to intercept and replace the executable with malicious code, leading to arbitrary code execution on systems running strider-sauce.
Technical details
The vulnerability is a lack of encryption (CWE-311) in the download mechanism used by strider-sauce. The library downloads executables over HTTP instead of HTTPS, making it vulnerable to man-in-the-middle (MITM) attacks. An attacker with a privileged network position (e.g., on a shared network, compromised router, or through DNS spoofing) can intercept the HTTP response and substitute a malicious executable. This results in arbitrary code execution with the privileges of the process running strider-sauce. The attack requires no authentication or user interaction. While a patch exists in the GitHub repository (commit 5ff6d65), it has not been published to npm with a version bump, leaving all versions up to 0.6.2 vulnerable.
Affected products
- Strider-CD strider-sauce <=0.6.2
Timeline
- 2019-02-18: disclosed