Executive brief
tomita-parser is a natural language processing library that downloads executable resources over unencrypted HTTP connections. An attacker with network access can intercept and replace these downloads with malicious code, leading to arbitrary code execution on systems where the package is installed.
Technical details
tomita-parser downloads executable files over unencrypted HTTP, allowing man-in-the-middle (MITM) attackers to intercept and replace the downloaded executable with a malicious one. The vulnerability exists in all versions up to 0.0.3. Exploitation requires a privileged network position (e.g., access to the target's network, ISP-level access, or DNS hijacking). The attack results in arbitrary code execution with the privileges of the process running tomita-parser. No patch has been released; the package has been unmaintained since 2015. Mitigation requires avoiding the package entirely or restricting its use to isolated private networks only.
Affected products
- tomita-parser tomita-parser 0.0.3 and earlier
Timeline
- 2019-02-18: disclosed
- 2016: other: CVE-2016-10666 assigned