Executive brief
ntfserver is a Node.js package that downloads executable resources over unencrypted HTTP. An attacker positioned on the network path (via compromised network infrastructure, ISP access, or public WiFi) can intercept and replace the downloaded executable with malicious code, achieving complete code execution on systems running this package.
Technical details
ntfserver is vulnerable to a man-in-the-middle (MITM) attack due to insecure download of executables over HTTP. The root cause is the use of unencrypted HTTP instead of HTTPS for downloading executable code, allowing attackers with network-level access (e.g., on shared networks, compromised ISPs, or privileged network positions) to intercept and modify the downloaded binary before it is executed. No encryption or integrity verification (cryptographic signatures or checksums) is employed. Exploitation requires a network-level attacker position but results in full code execution in the context of the ntfserver process. No patch has been released; remediation involves discontinuing use of the package or restricting its use to isolated networks where only trusted entities have access.
Affected products
- npm ntfserver 0.0.6 and earlier
Timeline
- 2019-02-18: disclosed