Executive brief
herbivore is a JavaScript library that downloads executable resources over unencrypted HTTP connections. An attacker positioned on the network path could intercept these downloads and replace the executable with malicious code, achieving arbitrary code execution on any system using the library.
Technical details
herbivore downloads executable resources over HTTP instead of HTTPS, violating secure transport principles (CWE-311: Missing Encryption of Sensitive Data). The vulnerability affects all versions up to 0.0.3. An attacker with network access (e.g., on the same WiFi, ISP, or via BGP hijacking) can perform a man-in-the-middle attack to intercept HTTP responses and replace the legitimate executable with a malicious payload, resulting in arbitrary code execution. The attack requires network-level access but no user interaction or authentication. The package author has reportedly patched the vulnerability in a rewritten version on GitHub but has not published an updated release to npm; users must install directly from the GitHub repository.
Affected products
- herbivore herbivore 0.0.3 and earlier
Timeline
- 2019-02-18: disclosed