Executive brief
node-thulac is a Node.js library for Chinese language processing. The package downloads required executable components over unencrypted HTTP, allowing attackers positioned on the network to intercept and replace those components with malicious ones, leading to arbitrary code execution during package installation or use.
Technical details
This vulnerability is a missing encryption issue (CWE-311) affecting node-thulac up to version 2.1.3. The library downloads an executable binary over an unencrypted HTTP connection without validating its integrity or authenticity. An attacker with a privileged network position (e.g., on a shared WiFi network, compromised ISP, or internal network compromise) can perform a man-in-the-middle attack to intercept the HTTP response and inject a malicious executable. The attack is triggered during package installation or when the library fetches resources at runtime. No patch is available; the vulnerability remains unresolved.
Affected products
- node-thulac node-thulac ≤ 2.1.3
Timeline
- 2019-02-18: disclosed
- other: Reported CVE is CVE-2016-10640, indicating original discovery predates this advisory publication