Executive brief
windows-build-tools is a Node.js package that downloads and installs Microsoft Visual C++ build tools required for native module compilation on Windows. The package downloaded the installer executable over unencrypted HTTP, allowing attackers on the network path to intercept and replace it with malicious code, leading to complete system compromise during installation.
Technical details
The vulnerability stems from an insecure download over HTTP (CWE-311) where windows-build-tools fetches a Visual C++ build tools executable from an unencrypted connection. An attacker positioned on the network (man-in-the-middle) can intercept the HTTP response and inject a malicious executable, resulting in arbitrary code execution with the privileges of the user running npm install. The vulnerable versions affected all releases before version 1.0.0, which was patched to use HTTPS. No user interaction beyond running the package installation is required; the attack requires network-level access (adjacent network position).
Affected products
- npm windows-build-tools before 1.0.0
Timeline
- 2018-11-09: disclosed