Executive brief
grunt-ccompiler is a build tool plugin that downloads compiler executables needed for its operation. The package downloads these executables over unencrypted HTTP connections, allowing an attacker on the network to intercept and replace the executable with malicious code, leading to arbitrary code execution during the build process. This risk is highest when the build tool is used on public or untrusted networks.
Technical details
The vulnerability is a missing encryption (CWE-311) issue where grunt-ccompiler downloads required executables using HTTP instead of HTTPS. An attacker with a privileged network position (man-in-the-middle capability) can intercept the HTTP response and inject a malicious executable in place of the legitimate one. This occurs at package installation or build time and does not require authentication. When the injected executable runs, the attacker achieves arbitrary code execution in the context of the user running the build process. No patch has been released and the original repository has been deleted; mitigation involves avoiding the package entirely or restricting its use to private, trusted networks.
Affected products
- npm grunt-ccompiler <= 0.1.0
Timeline
- 2019-02-18: disclosed