Executive brief
ipip-coffee is a Node.js library used to perform IP-based geolocation lookups. The package downloads geolocation resources over unencrypted HTTP instead of secure HTTPS, allowing attackers on the network path to intercept, modify, or read these resources. This compromises the accuracy and trustworthiness of geolocation data used by applications relying on this package.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where ipip-coffee downloads geolocation resources over HTTP instead of HTTPS. An attacker with a privileged network position (man-in-the-middle capability) can intercept and modify the resources in transit, leading to data integrity and confidentiality impacts. The attack vector is network-based with high attack complexity, requiring the attacker to be positioned on the network path during resource download. No patch has been made available; the recommendation is to discontinue use of the package or restrict its installation to private networks where such network-level attacks are less likely.
Affected products
- npm ipip-coffee <=1.0.9
Timeline
- 2019-02-18: disclosed
- 2019-02-18: advisory: GHSA-m8pw-h8qj-rgj9 published