Executive brief
headless-browser-lite is a Node.js library for browser automation. The library downloads executable resources over unencrypted HTTP connections, allowing attackers on the same network to intercept and replace them with malicious code, leading to complete compromise of the system running the application.
Technical details
The vulnerability is an insecure transport issue (CWE-311) where headless-browser-lite downloads executable binaries over HTTP instead of HTTPS. An attacker with network access (man-in-the-middle position) can intercept the download and substitute a malicious executable, achieving arbitrary code execution on the affected system. No authentication or user interaction is required; the attack exploits the default behavior of the library. The vulnerability affects all versions prior to 2015.4.18-a, which was the patched release.
Affected products
- npm headless-browser-lite <2015.4.18-a
Timeline
- 2019-02-18: disclosed: Advisory published
- 2015-04-18: patched: Fixed in version 2015.4.18-a