Executive brief
windows-selenium-chromedriver is a Node.js package that automates browser testing by downloading and managing ChromeDriver. The package downloads its executable over unencrypted HTTP instead of secure HTTPS, allowing attackers on the network path to intercept the download and inject malicious code that executes with full system privileges.
Technical details
The vulnerability is a cleartext transmission of sensitive information (CWE-311). The windows-selenium-chromedriver package downloads a ChromeDriver executable over HTTP without encryption or signature verification. An attacker positioned on the network path (e.g., on a shared WiFi network, compromised ISP, or within a network segment) can perform a man-in-the-middle attack to intercept the HTTP response and replace the legitimate executable with a malicious one. When the package executes the downloaded binary, the attacker-supplied code runs with the privileges of the user or process executing windows-selenium-chromedriver. No patch has been released; the package appears to be abandoned or unmaintained.
Affected products
- npm windows-selenium-chromedriver all versions from 0.0.0 onwards
Timeline
- 2020-09-01: disclosed: Published in GitHub Advisory Database
- other: CVE-2016-10687 assigned but NVD details not accessible