Executive brief
The webdriver-launcher library, used for managing Selenium Webdriver instances in Node.js, downloads necessary executable files over an unencrypted HTTP connection. This allows an attacker positioned on the same network to intercept the download and replace the legitimate software with malicious code. If exploited, this could lead to a full compromise of the system where the library is being installed or run.
Technical details
The webdriver-launcher package (all versions up to 0.1.3) fails to use TLS/SSL when fetching binary resources. This lack of encryption (CWE-311) allows a network-adjacent attacker or one with a privileged network position (such as a compromised ISP or rogue hotspot) to perform a Man-in-the-Middle (MITM) attack. By intercepting the HTTP traffic, the attacker can swap the requested executable with a malicious binary. Because the package does not perform integrity verification on the downloaded file, the malicious code is executed on the host system. No patch is available as the project has been inactive since 2011.
Affected products
- webdriver-launcher project webdriver-launcher <= 0.1.3
Timeline
- 2016-10-09: disclosed: Date associated with CVE identifier assignment
- 2018-06-04: advisory: NVD published date
- 2019-02-18: advisory: GitHub Advisory published