Executive brief
lix is a package manager for Haxe projects. The vulnerability allows an attacker with network access to intercept package downloads over HTTP and redirect installations to malicious sources, enabling code injection and compromise of the developer's project.
Technical details
lix accepts package downloads over unencrypted HTTP and blindly follows HTTP Location header redirects without verification. An attacker positioned on the network path (e.g., corporate proxy, compromised router, ISP level) can intercept package installation requests, respond with a redirect to a malicious package source, and inject arbitrary code into the developer's environment. The vulnerability affects all versions through 15.11.4, with no fix currently available as of the advisory date. The attack requires no authentication or user interaction beyond invoking the package manager.
Affected products
- lix-pm lix all versions through 15.11.4
Timeline
- 2020-04-16: disclosed
- 2020-04-16: advisory