Executive brief
qbs is a build automation tool that insecurely downloads executables over unencrypted HTTP connections. An attacker positioned on the network can intercept these downloads and inject malicious code, leading to arbitrary code execution during the build process. This poses a significant risk on public or untrusted networks where network traffic can be intercepted.
Technical details
The vulnerability is a missing encryption issue (CWE-311) in which qbs downloads executable resources over unencrypted HTTP rather than HTTPS. An attacker with a privileged network position (e.g., on the same network, controlling network infrastructure, or compromising ISP routing) can perform a man-in-the-middle attack to intercept the HTTP response and replace the executable with malicious code. This results in arbitrary code execution with the privileges of the user running qbs. The vulnerability affects all versions up to and including 1.4.3, with no patch currently available. Exploitation requires that the attacker be on the network path during the download, making the risk higher on public networks and lower on private/secured networks.
Affected products
- qbs qbs 1.4.3 and earlier
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: CVE assigned: CVE-2016-10656