Executive brief
The haxe3 package, a toolkit for cross-platform development, downloads executable resources over an unencrypted HTTP connection. This allows an attacker with a privileged network position, such as someone on the same public Wi-Fi or a compromised ISP, to intercept the download and replace it with malicious software. If exploited, this could lead to full control over the system where the package is being installed or run.
Technical details
The haxe3 npm package (a fork of haxe-npm) fails to use TLS/SSL when fetching executable resources during installation or runtime. This vulnerability is classified as a missing encryption of sensitive data (CWE-311). An attacker positioned between the user and the remote server can perform a Man-in-the-Middle (MitM) attack to intercept the HTTP traffic and inject a malicious payload in place of the legitimate executable. This results in Remote Code Execution (RCE) on the host machine. As of the latest advisory, no patch has been released by the maintainer, and users are advised to avoid the package or ensure installation occurs only on trusted, secure networks.
Affected products
- Haxe Foundation haxe3 <= 3.4.7
Timeline
- 2016-10-09: disclosed: Vulnerability identified (based on CVE year)
- 2018-06-04: advisory: NVD published date
- 2018-08-17: advisory: GitHub Advisory published