Executive brief
react-native-baidu-voice-synthesizer is a Node.js library for Baidu voice synthesis integration in React Native applications. The package downloads a critical executable over an unencrypted HTTP connection, allowing attackers with network access to intercept and replace it with malicious code, leading to complete system compromise and arbitrary code execution.
Technical details
The vulnerability is a missing encryption / insecure transmission issue (CWE-311) where react-native-baidu-voice-synthesizer downloads an executable resource over unencrypted HTTP instead of HTTPS. An attacker with a privileged network position (man-in-the-middle capability) can intercept the HTTP response during package installation or at runtime and substitute a malicious executable. This results in arbitrary code execution with the privileges of the user running the application. The vulnerability affects all versions up to and including 1.0.0, with no patch available. Exploitation requires network-level access or ISP/routing infrastructure compromise, making it practical primarily in public WiFi scenarios or compromised networks.
Affected products
- react-native-baidu-voice-synthesizer react-native-baidu-voice-synthesizer ≤ 1.0.0
Timeline
- 2018-07-31: disclosed
- 2018-07-31: advisory: Published to GitHub Advisory Database