Executive brief
xd-testing is a Node.js testing library that downloads executable resources over unencrypted HTTP connections. An attacker positioned on the network path (e.g., on a shared WiFi network or compromised ISP) can intercept these downloads and inject malicious code, gaining full control of the system running the package.
Technical details
xd-testing downloads executable binaries over unencrypted HTTP, making it vulnerable to man-in-the-middle (MITM) attacks. An attacker with network-level access (privileged network position, ISP compromise, or WLAN eavesdropping) can intercept the HTTP response and replace the legitimate executable with malicious code. No user interaction or authentication is required for exploitation. The attack succeeds when the package is installed from a public network or a compromised private network. No patch has been released; the vulnerability affects all versions through 1.0.1.
Affected products
- xd-testing xd-testing <=1.0.1
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: CVE-2016-10653 assigned