Executive brief
ikst is a Node.js library that downloads resources over unencrypted HTTP instead of HTTPS. An attacker positioned on the network path can intercept, modify, or read these downloads, potentially injecting malicious code into the application or stealing sensitive data. This creates a supply-chain risk for any application using the library.
Technical details
The vulnerability stems from missing encryption of sensitive data in transit (CWE-311). ikst downloads resources over HTTP rather than HTTPS, allowing attackers with network-level access (man-in-the-middle position) to read or modify resources in flight. The impact ranges from information disclosure to remote code execution, depending on what resources are downloaded and how they are used by the application. The vulnerability affects all versions prior to 1.1.2, which is the fixed version. The attack vector is network-based and requires an attacker to be positioned on the network path between the application and the remote resource server.
Affected products
- ikst ikst < 1.1.2
Timeline
- 2018-07-24: disclosed
- 2018: patched: Fixed in version 1.1.2