Executive brief
hubl-server is a Node.js package that downloads dependencies over unencrypted HTTP connections. An attacker positioned on the network path can intercept and replace these dependencies with malicious code, leading to remote code execution on systems running the package. The package has not been updated since 2015 and no patch is available.
Technical details
hubl-server fetches dependencies over plain HTTP rather than HTTPS, violating encryption best practices (CWE-311). An attacker with network access (e.g., on a shared WiFi network or with control of a network segment) can perform a man-in-the-middle attack to intercept HTTP responses and inject malicious payloads into downloaded dependencies. The vulnerability affects all versions up to 1.1.5 with no patch available. Exploitation requires the attacker to be positioned on the network path between the target system and the package repository and typically does not require authentication. Successful exploitation results in arbitrary code execution during dependency resolution.
Affected products
- hubl-server hubl-server <=1.1.5
Timeline
- 2018-07-24: disclosed: Published to GitHub Advisory Database
- 2015: other: Package last updated; no patches issued since this date