Executive brief
windows-iedriver is a Node.js library for driving Internet Explorer browser automation. The library downloads executable files over unencrypted HTTP connections, allowing network attackers to intercept and replace downloads with malicious code, resulting in arbitrary code execution on systems where the package is installed.
Technical details
windows-iedriver contains an insecure download vulnerability (CWE-311: Missing Encryption of Sensitive Data) in which the package fetches executables over HTTP rather than HTTPS. An attacker in a privileged network position (man-in-the-middle) can intercept the HTTP response and inject a malicious executable. The attack requires network proximity but no user interaction or authentication. Successful exploitation results in code execution with the privileges of the process running windows-iedriver. No patch has been released; the advisory recommends discontinuing use of this package.
Affected products
- npm windows-iedriver <=2.48.0
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: advisory: CVE-2016-10689 assigned