CVE-2016-10560: Insecure Download of Executable in galenframework-cli
Summary
CVE-2016-10560: Downloads Resources over HTTP in galenframework-cli. Affects galenframework-cli versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
galenframework-cli is an npm package that provides a command-line interface for the Galen Framework, which is a test automation tool for responsive web design. It allows users to write and execute tests for layout and design of web applications. The galenframework-cli package enables users to interact with the Galen Framework through the command line, providing a convenient way to run tests and generate reports. However, certain versions of galenframework-cli are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of galenframework-cli insecurely download an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. When the user runs galenframework-cli, the compromised executable will be executed, leading to code execution on the system running galenframework-cli. This vulnerability poses a significant risk as it allows an attacker to gain control over the affected system and potentially perform unauthorized actions.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
npm install galenframework-cli@2.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the galenframework-cli package is vulnerable to an insecure download of an executable, which can be intercepted and replaced by attackers. To mitigate this vulnerability, it is crucial to update galenframework-cli to version 2.3.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for galenframework-cli →
FAQ
galenframework-cli is an npm package that provides a command-line interface for the Galen Framework, allowing users to run tests and generate reports for responsive web design.
This vulnerability allows an attacker to replace the executable downloaded by galenframework-cli with a malicious one, leading to code execution on the system running galenframework-cli.
To mitigate this vulnerability, update galenframework-cli to version 2.3.1 or later, which ensures that the executable is downloaded over a secure HTTPS connection.
No, only versions prior to 2.3.1 are affected. Updating to version 2.3.1 or later resolves the vulnerability.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the latest version of galenframework-cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
