Executive brief
clang-extra is an npm package that downloads a compiler executable during installation. The package downloads this executable over unencrypted HTTP instead of HTTPS, allowing an attacker positioned on the network to intercept and replace it with malicious code. This results in arbitrary code execution on the system running clang-extra during installation.
Technical details
clang-extra downloads a compiler executable over HTTP without encryption (CWE-311: Missing Encryption of Sensitive Data). The vulnerability allows man-in-the-middle (MITM) attacks when the package is installed. An attacker positioned on the network path (e.g., compromised router, ISP-level access, or unsecured public WiFi) can intercept the HTTP response and inject a malicious executable. This results in arbitrary code execution during package installation with the privileges of the installing user. The attack requires network-level access but no authentication or user interaction beyond running the package installer. No patch is currently available; the package author indicates that HTTPS support would require upstream HTTPS support from LLVM.
Affected products
- clang-extra clang-extra <= 0.1.1
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: CVE-2016-10655 assigned