Executive brief
The alto-saxophone library, used to manage Chromedriver installations, downloads executable files over an insecure HTTP connection. An attacker positioned on the same network could intercept this download and replace the legitimate file with malicious software. This could allow an attacker to take full control of the system running the library.
Technical details
The alto-saxophone npm package (versions prior to 2.25.1) fails to use TLS/SSL when fetching binary resources, specifically Chromedriver executables. This lack of encryption (CWE-311) allows a network-positioned attacker to perform a Man-in-the-Middle (MitM) attack. By intercepting the unencrypted HTTP traffic, the attacker can swap the requested binary with a malicious payload. When the library executes the downloaded file, it results in remote code execution (RCE) on the host system. The vulnerability is addressed in version 2.25.1 by switching to HTTPS for resource downloads.
Affected products
- alto-saxophone project alto-saxophone < 2.25.1
Timeline
- 2016-02-26: disclosed: Date based on CVE assignment year and npm advisory history
- 2018-06-04: advisory: NVD published date
- 2018-07-31: advisory: GitHub Advisory published date