Executive brief
node-air-sdk is a Node.js library for Adobe AIR SDK integration. The package downloads executables over unencrypted HTTP, allowing attackers on the network path to intercept and replace the executable with malicious code, leading to arbitrary code execution on systems where the package is installed.
Technical details
The vulnerability is an insecure download over HTTP (CWE-311: Missing Encryption of Sensitive Data). During installation or execution, node-air-sdk retrieves a binary executable over an unencrypted HTTP connection without integrity verification. An attacker with a privileged network position (MITM capability) can intercept the download and inject a malicious executable, achieving code execution with the privileges of the node process. The risk is highest on public networks; private networks are only vulnerable to insider threats or compromised network infrastructure. No patch exists; users are advised to discontinue use or avoid installation on public networks.
Affected products
- npm node-air-sdk all versions
Timeline
- 2016: disclosed: CVE-2016-10647 assigned
- 2020-09-01: advisory: GHSA-7hvm-29rf-2gf2 published