Executive brief
co-cli-installer is an npm package that downloads and installs command-line tools. The package downloads executable files over unencrypted HTTP connections instead of secure HTTPS. An attacker with network access (such as on a public WiFi network or a compromised ISP) can intercept the download and inject malicious code, gaining complete control over the system running the installer.
Technical details
This vulnerability is a man-in-the-middle (MITM) attack vector caused by insecure transport of executable resources. The co-cli-installer package downloads binaries over unencrypted HTTP, allowing attackers on the network path to intercept and modify the response. The attack requires a privileged network position (public WiFi, ISP level access, or network compromise) but results in arbitrary code execution with the privileges of the installing user. The advisory notes that no patch has been released; the only mitigations are to avoid the package entirely or restrict installation to private networks.
Affected products
- co-cli-installer co-cli-installer <=0.0.2
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: other: CVE-2016-10657 assigned (year based on CVE ID pattern)