Executive brief
fibjs is a JavaScript runtime library that downloads executable files over unencrypted HTTP connections. An attacker positioned on the network can intercept these downloads and inject malicious code, gaining complete control over systems running the affected software. This is particularly dangerous during initial package installation or updates on public networks.
Technical details
The vulnerability stems from downloading executable dependencies over HTTP rather than HTTPS (CWE-311: Missing Encryption of Sensitive Data). An attacker with network access (man-in-the-middle position) can intercept the download response and replace the legitimate executable with a malicious payload, achieving arbitrary code execution with the privileges of the user running fibjs. The attack requires no authentication or user interaction beyond the normal installation or update process. No patch has been released; mitigation requires avoiding the package or restricting installation to private networks.
Affected products
- fibjs fibjs ≤0.1.8
Timeline
- 2019-02-18: disclosed: GHSA-6p48-xfj3-jw67 published
- 2016: advisory: CVE-2016-10621 assigned (estimated year from CVE numbering)