Executive brief
node-bsdiff-android is a Node.js library for binary patching operations. The library downloads resources over unencrypted HTTP, allowing attackers on privileged network positions (such as compromised ISPs or corporate networks) to intercept, read, or modify these downloads, potentially leading to code execution or data theft.
Technical details
The vulnerability stems from insecure HTTP resource downloads in the node-bsdiff-android package (CVE-2016-10641, CWE-269, CWE-311). Resources are fetched over HTTP without encryption or integrity verification, making them susceptible to man-in-the-middle (MITM) attacks by any actor with privileged network access. An attacker positioned between the client and remote server can intercept, read, or modify downloaded resources at will. Depending on the nature of resources and how they are used by the application, exploitation could range from information disclosure to remote code execution. No patch has been released since the package's last update in 2014. The recommended mitigation is to discontinue use of this package and replace it with an actively maintained alternative.
Affected products
- npm node-bsdiff-android 0.1.5 and earlier
Timeline
- 2018-09-18: disclosed: Published to GitHub Advisory Database
- 2020-06-16: advisory: GitHub reviewed and confirmed the advisory