Executive brief
marionette-socket-host is a Node.js package that downloads executables over unencrypted HTTP connections. An attacker with network access can intercept these downloads and inject malicious code, gaining complete control of the system running the package.
Technical details
The vulnerability is a missing encryption / insecure transport issue (CWE-311, CWE-269) where marionette-socket-host downloads executable resources over unencrypted HTTP instead of HTTPS. An attacker with a privileged network position (man-in-the-middle capability) can intercept the HTTP response and replace the executable with malicious code. The attack requires network access but no authentication or user interaction. Successful exploitation results in arbitrary code execution with the privileges of the process running marionette-socket-host. No patch is available; the package has been removed from the author's GitHub account.
Affected products
- Mozilla marionette-socket-host <= 0.1.1
Timeline
- 2018-08-15: disclosed