Executive brief
broccoli-closure is a Node.js build tool used during the development of JavaScript applications. The library downloads executables over unencrypted HTTP, allowing attackers with network access (such as on shared WiFi or compromised network infrastructure) to intercept and replace the download with malicious code, leading to arbitrary code execution during the build process.
Technical details
The vulnerability stems from the use of unencrypted HTTP to download executable resources, classified as missing encryption of sensitive data (CWE-311). An attacker with a privileged network position (e.g., on the same network, controlling a router, or intercepting traffic) can perform a man-in-the-middle attack to replace the legitimate executable with malicious code. This occurs at build time when broccoli-closure downloads dependencies, affecting any developer or CI/CD system using affected versions. The vulnerability is fixed in version 1.3.1 and later by switching to HTTPS for secure downloads.
Affected products
- npm broccoli-closure < 1.3.1
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2019-02-18: patched: Fix available in version 1.3.1 or later