Executive brief
windows-seleniumjar-mirror is an npm package that downloads the Selenium WebDriver executable for Windows testing automation. The package downloads this executable over an unencrypted HTTP connection, allowing a network attacker to intercept the download and inject malicious code. This leads to complete system compromise and code execution. No patch is available; affected users should manually download from the official source or avoid using the package on untrusted networks.
Technical details
The vulnerability is a missing encryption/insecure transport issue (CWE-311) where windows-seleniumjar-mirror downloads an executable over HTTP rather than HTTPS. An attacker positioned to observe or intercept network traffic (on a public Wi-Fi, compromised ISP, or similar privileged network position) can perform a man-in-the-middle attack to replace the legitimate executable with malicious code during download. This results in arbitrary code execution with the privileges of the process installing the package. The attack requires no authentication and affects all versions up to 2.52.1. No patch has been released; the advisory recommends manual download from SeleniumHQ or restricting installation to private/trusted networks only.
Affected products
- npm windows-seleniumjar-mirror 0 through 2.52.1
Timeline
- 2019-02-18: disclosed