Executive brief
nodeschnaps is a Node.js utility that downloads executable resources as part of its operation. The package downloads these executables over unencrypted HTTP instead of secure HTTPS, allowing attackers positioned on the network to intercept and replace the executable with malicious code, leading to complete code execution on systems using the package.
Technical details
The vulnerability is an insecure transport issue (CWE-311: Missing Encryption of Sensitive Data). nodeschnaps downloads executable files over unencrypted HTTP connections, which exposes the download to man-in-the-middle attacks. An attacker with a privileged network position (e.g., on the same network, controlling a router, or performing BGP hijacking) can intercept the HTTP response and replace the executable with a malicious payload. No authentication is required; the attack requires only network interception capability and occurs passively during normal package operation. The impact is arbitrary code execution with the privileges of the process running nodeschnaps. The vulnerability was fixed in version 1.0.3 and later.
Affected products
- nodeschnaps nodeschnaps < 1.0.3
Timeline
- 2019-02-18: disclosed
- 2016: patched: CVE-2016-10622 issued; fix available in version 1.0.3