Executive brief
dalek-browser-ie-canary is a browser automation testing tool that downloads executable files over unencrypted HTTP. An attacker positioned on the network path can intercept and replace the downloaded executable with malicious code, gaining full control of the system running the tool.
Technical details
The vulnerability is a missing encryption flaw (CWE-311) where dalek-browser-ie-canary downloads executables over unencrypted HTTP instead of HTTPS. The attack requires network-level access to intercept and modify the HTTP response—achievable by an attacker on the same network, at an ISP level, or via man-in-the-middle techniques. No user interaction or privileges are required; exploitation results in arbitrary code execution with the privileges of the running process. No patch has been released; the package is deprecated and should be abandoned in favor of alternatives.
Affected products
- npm dalek-browser-ie-canary <= 0.0.4-2014-04-04-12-11-49
Timeline
- 2019-02-18: disclosed
- other: Package marked as deprecated; no patch released