Executive brief
mystem3 is a Node.js module that interfaces with linguistic analysis tools. The library insecurely downloads executable binaries over HTTP instead of HTTPS, allowing attackers positioned on the network to intercept and replace the binary with malicious code, resulting in arbitrary code execution on systems using the library.
Technical details
The vulnerability is an insecure download issue (CWE-311: missing encryption of sensitive data) in mystem3's binary download mechanism. The affected versions download an executable over unencrypted HTTP, making it susceptible to man-in-the-middle (MITM) attacks. An attacker with network access can intercept the download response and inject malicious code. No authentication or user interaction is required; exploitation depends on network position and occurs during package initialization or binary download. The fix involves switching to HTTPS for all binary downloads, which was implemented in version 1.0.8.
Affected products
- npm mystem3 < 1.0.8
Timeline
- 2019-02-18: disclosed
- 1.0.8: patched: Fix implemented to download binaries over HTTPS