Executive brief
cloudpub-redis is a Node.js library for interacting with Redis. The package insecurely downloads an executable over unencrypted HTTP, allowing a network attacker to intercept the download and inject malicious code, leading to arbitrary code execution on systems using this library.
Technical details
The vulnerability is a missing encryption of sensitive data (CWE-311) affecting cloudpub-redis versions up to 2.4.5. During installation or runtime, the package downloads an executable over an unencrypted HTTP connection instead of HTTPS. An attacker positioned on the network path (e.g., on a public WiFi, compromised router, or ISP level) can perform a man-in-the-middle (MITM) attack to intercept and replace the executable with a malicious binary. This results in arbitrary code execution with the privileges of the user running the package. No patch has been released; the advisory recommends discontinuing use of this package or restricting installation to private networks only.
Affected products
- cloudpub-redis cloudpub-redis up to 2.4.5
Timeline
- 2019-02-18: disclosed
- other: CVE-2016-10672 assigned (NVD publication date unknown)