CVE-2016-10566: Insecure Download of Executable in install-nw
Summary
CVE-2016-10566: install-nw downloads Resources over HTTP. Affects install-nw versions < 1.1.5. Fixed in 1.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
install-nw is an npm package used for downloading resources. It allows users to securely download and install applications. However, certain versions of install-nw are vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running install-nw.
Vulnerability Detail
The vulnerability in install-nw arises from the insecure download of an executable over an unencrypted HTTP connection. When an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can result in the execution of arbitrary code on the system running install-nw. The impact of this vulnerability is significant as it allows an attacker to compromise the integrity and security of the system.
How To Fix
Minimum fixed version
1.1.5
This is the first release that contains the fix.
npm install install-nw@1.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in install-nw that allows for the insecure download of an executable over an unencrypted HTTP connection can have severe consequences, including the execution of arbitrary code on the system. It is crucial to update to version 1.1.5 or later of install-nw to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for install-nw →
FAQ
The impact of this vulnerability is significant as it allows an attacker to compromise the integrity and security of the system by replacing the downloaded executable with a malicious one.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
This vulnerability requires an attacker to have a privileged network position to intercept the response and replace the executable. Therefore, it cannot be exploited remotely unless the attacker has control over the network infrastructure.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of install-nw to mitigate the risk.
There is no evidence of this vulnerability being exploited in the wild. However, it is important to update to the latest version of install-nw to ensure the security of your system.
