Executive brief
The box2d-native library, used for physics simulations in software development, downloads necessary executable files over an insecure, unencrypted connection. An attacker positioned on the same network could intercept this download and replace the legitimate file with malicious software. This could allow an attacker to take full control of the system where the library is being installed or run.
Technical details
The box2d-native package for npm insecurely fetches binary resources using the HTTP protocol instead of HTTPS. This lack of encryption (CWE-311) allows an attacker with a privileged network position (such as on a public Wi-Fi or a compromised ISP) to perform a Man-in-the-Middle (MitM) attack. By intercepting the unencrypted traffic, the attacker can replace the intended executable with a malicious payload. This results in arbitrary code execution on the victim's machine during the package installation or resource download phase. No patch is currently available, and users are advised to migrate to alternative packages.
Affected products
- box2d-native project box2d-native <= 0.0.8
Timeline
- 2016-10-09: disclosed: Vulnerability identified via HackerOne
- 2018-06-01: advisory: NVD published date
- 2019-02-18: advisory: GitHub Advisory published