Executive brief
The selenium-standalone-painful package, used to automate web browser testing, downloads necessary software components over an unencrypted connection. An attacker on the same network could intercept this process and replace the legitimate software with malicious code. This could allow an attacker to take full control of the computer where the package is being installed or run.
Technical details
The selenium-standalone-painful package (versions up to 2.39.0-2.7.0) is vulnerable to a Man-in-the-Middle (MITM) attack because it retrieves executable binaries, such as the Selenium server and ChromeDriver, over unencrypted HTTP. An attacker with a privileged network position (e.g., on a public Wi-Fi or a compromised ISP) can intercept the download request and inject a malicious payload in place of the legitimate executable. This results in arbitrary code execution on the host system during the installation or setup phase. No patch is currently available, and users are advised to migrate to alternative packages or ensure installations occur only on trusted, secure networks.
Affected products
- selenium-standalone-painful project selenium-standalone-painful <= 2.39.0-2.7.0
Timeline
- 2016-10-09: disclosed: Vulnerability identified via HackerOne
- 2018-05-29: advisory: NVD published CVE-2016-10679
- 2019-02-18: advisory: GitHub Advisory published