CVE-2016-10579: Insecure Resource Download in chromedriver
Summary
CVE-2016-10579: chromedriver Downloads Resources over HTTP. Affects chromedriver versions < 2.25.2. Fixed in 2.25.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chromedriver is an npm package that provides a WebDriver implementation for Chrome. It allows developers to automate interactions with the Chrome browser for testing and other purposes. The package is widely used in the development community. However, certain versions of chromedriver are vulnerable to an insecure resource download issue.
Vulnerability Detail
The affected versions of chromedriver insecurely download resources over HTTP. This means that if an attacker has a privileged network position, they can modify or read these resources. This could lead to arbitrary code execution if the attacker intercepts and replaces the downloaded binary file with a malicious one. The vulnerability has a severity rating of HIGH and is classified under CWE-311.
How To Fix
Minimum fixed version
2.25.2
This is the first release that contains the fix.
npm install chromedriver@2.25.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The insecure resource download vulnerability in chromedriver can be mitigated by updating to version 2.26.1 or later. It is important to promptly apply this fix to ensure the secure downloading of resources and prevent potential arbitrary code execution. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for chromedriver →
FAQ
chromedriver is an npm package that provides a WebDriver implementation for Chrome. It allows developers to automate interactions with the Chrome browser for testing and other purposes.
The vulnerability allows attackers with a privileged network position to modify or read resources downloaded by chromedriver. This could result in arbitrary code execution if a malicious file is substituted for the downloaded binary.
To fix this vulnerability, update your chromedriver package to version 2.26.1 or later.
No workaround is mentioned for this vulnerability. It is recommended to update to the fixed version.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-jh5w-6964-x5cf/GHSA-jh5w-6964-x5cf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for chromedriver.
