Executive brief
openframe-image is a Node.js package that extends Openframe, a platform for displaying digital art, by adding support for static images. The package insecurely downloads resources over HTTP instead of HTTPS, allowing attackers on the same network to intercept and modify downloads. Depending on what resources are downloaded, this could lead to sensitive information disclosure or remote code execution.
Technical details
openframe-image downloads external resources using insecure HTTP instead of HTTPS, creating a vulnerability classified under CWE-269 (improper access control) and CWE-311 (missing encryption of sensitive data). An attacker with network-level access (e.g., shared WiFi, compromised ISP, or internal network position) can intercept and modify these downloads without authentication. The impact ranges from reading sensitive information to achieving remote code execution, depending on how the downloaded resources are used by the package. No patch is available; the recommended mitigation is to avoid using this package or restrict its use to private networks where network access is controlled.
Affected products
- OpenframeProject openframe-image ≤0.2.3
Timeline
- 2019-02-18: disclosed