Executive brief
curses is a Node.js library that downloads executable resources over unencrypted HTTP instead of HTTPS. An attacker positioned on a network path (such as a malicious WiFi hotspot or compromised ISP) can intercept the download and serve malicious code, leading to arbitrary code execution on systems where curses is installed.
Technical details
This vulnerability exists in the curses npm package (versions <= 0.0.10), which downloads executable files over HTTP rather than secure HTTPS. The insecure download mechanism is vulnerable to man-in-the-middle (MITM) attacks where an attacker with network access (CWE-311: Missing Encryption of Sensitive Data) can intercept the HTTP response and replace the executable with malicious code. Exploitation requires the attacker to have a privileged network position (adjacent attack vector) such as control of a router, compromised network, or ISP-level access. No patch has been released, and the package has been unmaintained since 2013.
Affected products
- npm curses <= 0.0.10
Timeline
- 2019-02-18: disclosed
- other: Package unmaintained since 2013; no patch available