Executive brief
native-opencv is an npm library that binds OpenCV image processing functionality to Node.js. The library downloads a required executable over an unencrypted HTTP connection, allowing attackers on the network path to intercept and replace it with malicious code, resulting in complete code execution on the affected system.
Technical details
The vulnerability is a missing encryption/integrity check (CWE-311) in how native-opencv fetches its binary dependencies. The library downloads an executable over unencrypted HTTP, making it vulnerable to man-in-the-middle (MITM) attack during installation or runtime initialization. No authentication or signature verification protects the download. The attack vector is network-based and requires the attacker to have a privileged network position (compromised router, ISP access, or public network sniffing). When exploited, an attacker gains arbitrary code execution with the privileges of the process running native-opencv. No patch is available; the package has been unmaintained since 2015.
Affected products
- npm native-opencv ≤ 3.0.0
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2015: other: Package last updated; no subsequent maintenance