Executive brief
node-browser is a Node.js library that downloads resources over unencrypted HTTP instead of secure HTTPS. An attacker positioned on the network path (such as a compromised ISP or rogue network administrator) can intercept, read, or modify these resources in transit. Depending on what resources are downloaded, this could enable theft of sensitive data or injection of malicious code.
Technical details
The vulnerability is an insecure transport flaw (CWE-311: Missing Encryption of Sensitive Data) where node-browser downloads resources over HTTP rather than HTTPS. An attacker with a privileged network position (man-in-the-middle) can intercept and modify downloaded resources without detection. The attack requires network-level access but no authentication or user interaction. Impact ranges from confidentiality loss (data exposure) to integrity compromise (malicious code injection, potentially achieving remote code execution) depending on what resources are downloaded and how they are used. No patch is available; the package is effectively unmaintained.
Affected products
- npm node-browser ≤0.0.3
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: CVE-2016-10618 assigned (estimated from CVE year)
- other: No patch available; package effectively unmaintained