Executive brief
selenium-chromedriver is a Node.js package that automates browser testing by downloading and executing the Chrome WebDriver binary. The package downloads this executable over an unencrypted HTTP connection, allowing an attacker positioned on the network to intercept and replace it with malicious code, leading to arbitrary code execution on systems where the tool is installed.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where selenium-chromedriver downloads an executable resource over HTTP rather than HTTPS. An attacker with network-level access (e.g., on a shared WiFi network or compromised router) can perform a man-in-the-middle attack to intercept the HTTP response and inject malicious code. No authentication or user interaction is required for the attack to succeed. No patch has been released; the package is deprecated and the recommendation is to stop using it entirely or avoid installation on untrusted networks.
Affected products
- npm selenium-chromedriver <=0.0.2
Timeline
- 2019-02-18: disclosed