Executive brief
Tomita is a Node.js package that downloads executable files over unencrypted HTTP connections. An attacker positioned on a network between the user and the download server can intercept the download and inject malicious code, leading to arbitrary code execution on the affected system. No security patch has been released.
Technical details
The vulnerability is a man-in-the-middle (MITM) attack vulnerability resulting from insecure download of executable binaries over HTTP instead of HTTPS (CWE-311: Missing Encryption of Sensitive Data). When tomita is installed or executed, it downloads an executable over an unencrypted HTTP channel, allowing an attacker with privileged network position (e.g., on a public WiFi network, compromised ISP, or local network access) to intercept and modify the response. The attack requires network proximity to intercept traffic but no authentication or user interaction beyond running the package. An attacker can achieve arbitrary code execution with the privileges of the user installing or running tomita. No patch is available; the advisory recommends avoiding use of the package or restricting installation to private networks with trusted access controls.
Affected products
- npm tomita 0.0.1 and earlier
Timeline
- 2019-02-18: disclosed
- 2016: advisory: CVE-2016-10662 assigned