Executive brief
haxe-dev is a compiler toolchain used by developers to build applications. The package downloads required executables over unencrypted HTTP, allowing an attacker with network access to intercept and replace the executable with malicious code, leading to arbitrary code execution on the developer's machine.
Technical details
This vulnerability involves insecure transmission of executable resources via HTTP without encryption or integrity checks (CWE-311). An attacker positioned on the network path (e.g., via ARP spoofing, DNS hijacking, or ISP compromise) can perform a man-in-the-middle attack to intercept the HTTP response and serve a malicious executable. The attack requires no authentication or special privileges on the target system, only network-level access. The vulnerability affects all versions up to and including 3.2.1, with no patch available as of the advisory publication date despite the package being actively maintained.
Affected products
- haxe-dev haxe-dev <=3.2.1
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: advisory: CVE-2016-10637 assigned