Executive brief
windows-latestchromedriver is a Node.js package that automatically downloads and manages the latest Chrome WebDriver executable. The package downloads this executable over unencrypted HTTP, allowing attackers with network access (such as on a public WiFi network or with ISP-level access) to intercept the download and inject a malicious executable, leading to arbitrary code execution on the affected system.
Technical details
The vulnerability is a cleartext transmission issue (CWE-311) where windows-latestchromedriver downloads an executable binary over HTTP rather than HTTPS. The attack vector is network-based and requires the attacker to be positioned on the network path between the package installation environment and the download server (e.g., compromised public WiFi, network-level eavesdropping, or ISP-level interception). No user interaction or authentication is required—the malicious executable is automatically downloaded and executed when the package initializes. An attacker can achieve arbitrary code execution with the privileges of the user running the application. No patch has been released for this vulnerability; the official recommendation is to cease use of the package entirely or restrict installation to trusted private networks only.
Affected products
- npm windows-latestchromedriver 0.0.0 and later (all versions)
Timeline
- 2020-09-01: disclosed: Vulnerability published to GitHub Advisory Database
- 2016: other: Original CVE-2016-10696 assigned