Executive brief
js-given is a JavaScript testing library that downloads executable resources during its operation. Affected versions download these resources over unencrypted HTTP, allowing attackers on the network path to intercept and replace the executable with malicious code, leading to arbitrary code execution on the developer's machine.
Technical details
The vulnerability is a cleartext protocol download issue (CWE-311) where js-given fetches an executable over HTTP instead of HTTPS. An attacker positioned on the network (e.g., compromised router, shared WiFi, ISP-level access) can perform a man-in-the-middle attack to intercept the HTTP response and inject a malicious executable. This requires no authentication or user interaction beyond running js-given in a vulnerable state. The attack results in arbitrary code execution with the privileges of the user running the test framework. The vulnerability was fixed in version 0.0.18.
Affected products
- jsGiven js-given before 0.0.18
Timeline
- 2019-02-18: disclosed
- 2016: patched: Fixed in version 0.0.18