Executive brief
roslib-socketio is a JavaScript library for Robot Operating System (ROS) communication. The library downloads executable resources over unencrypted HTTP connections, allowing attackers on the network path to intercept and replace the executable with malicious code. This can lead to arbitrary code execution on systems using the library, particularly when installed on public networks or untrusted connections.
Technical details
The vulnerability is a cleartext protocol usage (CWE-311) in which roslib-socketio downloads executable resources over HTTP rather than HTTPS. An attacker positioned on the network path between the client and server (e.g., on a compromised network, rogue ISP, or via network sniffing on a public WiFi) can intercept the HTTP response and serve a malicious executable instead of the legitimate one. This results in code execution with the privileges of the Node.js process running the library. The attack requires network-level access but no authentication or user interaction. No patch is currently available; the recommendation is to avoid using the package entirely or to restrict its use to isolated private networks.
Affected products
- roslib-socketio roslib-socketio
Timeline
- 2020-09-01: disclosed