Executive brief
httpsync is a Node.js package used for synchronous HTTP operations. The package downloads executable resources over unencrypted HTTP instead of HTTPS, allowing attackers on the network path to intercept and replace the executable with malicious code, achieving arbitrary code execution on the host system.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where httpsync downloads executable resources over unencrypted HTTP rather than HTTPS. An attacker positioned on the network path between the client and server (via compromised network infrastructure, rogue ISP access, or local network compromise) can perform a man-in-the-middle attack to intercept the download and inject malicious code. This results in arbitrary code execution with the privileges of the process running httpsync. No patch has been released; the only mitigation is to discontinue use of the package or restrict its use to private networks where network access is tightly controlled.
Affected products
- npm httpsync 0.0.8 and earlier
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: CVE-2016-10614 assigned (year approximate)