Executive brief
mystem-wrapper is a Node.js library that downloads language processing tools needed for operation. The package downloads an executable over unencrypted HTTP, allowing an attacker on a network segment (such as a compromised WiFi network or ISP) to intercept and replace the download with malicious code, resulting in complete system compromise during installation or initialization.
Technical details
The vulnerability is a cleartext transmission issue (CWE-311) in which mystem-wrapper downloads an executable binary over HTTP instead of HTTPS. An attacker positioned on the network path between the package installation and the remote server (man-in-the-middle attack) can intercept the HTTP response and serve a malicious executable. The attack requires network-level access but no authentication or user interaction beyond installing or using the package. The vulnerable component is the download mechanism during package initialization. No patch has been released; the only mitigation is to avoid using the package or to restrict installation to private networks with trusted infrastructure.
Affected products
- npm mystem-wrapper ≤ 0.2.0
Timeline
- 2019-02-18: disclosed
- other: CVE-2016-10671 assigned