Executive brief
The libsbml npm package downloads an executable helper file over an unencrypted HTTP connection when installed or used. Someone with control over the network path—such as on public Wi-Fi, a compromised ISP, or a nation-state-level adversary—could intercept that download and swap in malicious software, gaining the ability to run arbitrary code on the affected system. There is no vendor fix available, and the package itself has been unmaintained since 2013, so organizations should avoid using it or ensure it is only ever installed from trusted, private networks.
Technical details
The vulnerability (CWE-311, Missing Encryption of Sensitive Data) stems from libsbml's installation/runtime process fetching an executable resource over plain HTTP rather than HTTPS. This lack of transport encryption and integrity verification allows a man-in-the-middle attacker (e.g., on a shared/public network, a rogue ISP, or a compromised intermediate router) to intercept and replace the downloaded binary with an attacker-controlled executable. Since the executable is then run on the host, this results in full arbitrary code execution with the privileges of the process performing the install/download. Exploitation requires the attacker to have a privileged network position but no authentication or user interaction beyond normal package installation/use. No patch is available; the package has not been updated since 2013. Mitigation is to avoid the package, replace it with an alternative, or only install/use it on trusted private networks.
Affected products
- libsbml libsbml (npm package) <= 0.0.2, all versions
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2020-06-16: advisory: GitHub reviewed advisory