Executive brief
The sfml npm package downloads resources over unencrypted HTTP connections rather than secure HTTPS. An attacker positioned on the network path (e.g., on a compromised WiFi network or ISP) can intercept and modify these downloads, potentially injecting malicious code or stealing sensitive information. The actual impact depends on what data the package handles, ranging from information disclosure to remote code execution.
Technical details
The vulnerability exists in sfml versions 0.0.3 and earlier, which download resources over cleartext HTTP instead of HTTPS. This is a case of insufficient transport security (CWE-311: Missing Encryption of Sensitive Data). An attacker with a privileged network position—such as on a shared WiFi network, a compromised ISP, or within an enterprise network—can perform man-in-the-middle (MITM) attacks to intercept, read, and modify the downloaded resources. Since the resources are not authenticated or validated, the attacker's modifications will be accepted and used by the application. The impact ranges from information disclosure (reading sensitive data) to remote code execution (injecting malicious code if the resources are executable). No patch is currently available; the recommended mitigations are to avoid using the package entirely or to ensure it is only used on private, trusted networks.
Affected products
- npm sfml 0.0.3 and earlier
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database