Executive brief
mystem-fix is a Node.js package that downloads an executable binary as part of its installation or initialization. The package downloads this executable over an unencrypted HTTP connection instead of the secure HTTPS protocol. An attacker positioned on the network path can intercept and replace the downloaded executable with malicious code, leading to arbitrary code execution on systems using the package.
Technical details
The vulnerability is a cleartext transmission of sensitive data (CWE-311) where mystem-fix downloads an executable over HTTP instead of HTTPS. The attack requires network-level access to intercept and modify the HTTP response (man-in-the-middle position). Any system downloading and executing the package is vulnerable; no authentication is required. An attacker can achieve arbitrary code execution by serving a malicious executable in place of the legitimate one. No patch has been released; the maintainers recommend discontinuing use of the package.
Affected products
- npm mystem-fix 0.0.5 and earlier
Timeline
- 2018-07-27: disclosed
- 2020-06-16: advisory: GitHub reviewed and confirmed