Executive brief
google-closure-tools-latest is an npm package that downloads the Closure Compiler executable during installation. The package downloads this executable over unencrypted HTTP, allowing attackers on the same network to intercept and replace it with malicious code. Exploitation requires a privileged network position and results in arbitrary code execution with the privileges of the installing user.
Technical details
This vulnerability is caused by downloading executable resources over unencrypted HTTP (CWE-311: Missing Encryption of Sensitive Data). The package fails to verify the integrity or authenticity of downloaded binaries and makes no use of HTTPS. An attacker positioned on the network path between the installation system and the remote server can perform a man-in-the-middle attack to inject malicious executables. The attack requires network-level access (adjacent network position or ISP-level capabilities) but no authentication or user interaction beyond running package installation. No patch has been released; the only mitigation is to avoid the package entirely or restrict installation to private networks.
Affected products
- npm google-closure-tools-latest <=0.1.1
Timeline
- 2019-02-18: disclosed
- 2016: other: CVE-2016-10677 assigned