Executive brief
haxeshim is a Node.js package that downloads build tools during installation. The package downloads an executable over an unencrypted HTTP connection, allowing attackers positioned on the network path to intercept and replace the executable with malicious code, leading to arbitrary code execution on the user's system.
Technical details
haxeshim insecurely downloads an executable resource over HTTP rather than HTTPS, creating a man-in-the-middle (MITM) vulnerability. An attacker with network access between the target system and the download server (e.g., on a shared public Wi-Fi network, compromised ISP, or BGP hijack) can intercept the HTTP response and inject a malicious executable. No user interaction is required; exploitation occurs automatically during package installation or use. The vulnerability affects all versions up to and including 0.12.4, with no patch currently available. Mitigation requires avoiding the package entirely or restricting its use to private, secured networks.
Affected products
- haxeshim haxeshim 0.12.4 and earlier
Timeline
- 2018-07-31: disclosed
- other: CVE-2016-10692 assigned