Executive brief
adamvr-geoip-lite is a Node.js library for geolocation lookups that downloads geographic data from the internet. It fetches this data over unencrypted HTTP rather than secure HTTPS, allowing attackers with network access to intercept, modify, or read the data in transit. This could corrupt the geolocation information used by applications, leading to incorrect location-based decisions or availability issues.
Technical details
The vulnerability is an insecure transport issue (CWE-311) where adamvr-geoip-lite downloads geolocation resources over HTTP instead of HTTPS. An attacker with a privileged network position (man-in-the-middle capability) can intercept and modify these resources at will, compromising the integrity and availability of the geolocation data. Attack requires no authentication and is feasible on any public network or compromised private network. No patch is available; the recommended mitigation is to avoid using this package or to ensure it is not used on public networks.
Affected products
- adamvr geoip-lite all versions from 0.0.0 onwards
Timeline
- 2020-09-01: disclosed: Advisory published on GitHub