CVE-2016-10584: Insecure Download of Executable in dalek-browser-chrome-canary
Summary
CVE-2016-10584: Downloads Resources over HTTP in dalek-browser-chrome-canary. Affects dalek-browser-chrome-canary versions < 0.0.10-2014-03-24-17-36-27. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dalek-browser-chrome-canary is an npm package that provides a browser automation library for Chrome Canary. It allows users to interact with Chrome Canary programmatically. The package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running dalek-browser-chrome-canary.
Vulnerability Detail
The vulnerability in dalek-browser-chrome-canary arises from the insecure download of an executable over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. The impact of this vulnerability is that an attacker can execute arbitrary code on the system running dalek-browser-chrome-canary, potentially leading to further compromise of the system. The vulnerability is classified as CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The dalek-browser-chrome-canary package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system running the package if an attacker has a privileged network position. Currently, there is no patch available for this vulnerability. The best mitigation is to avoid using the package and use an alternative if possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dalek-browser-chrome-canary →
FAQ
The impact of this vulnerability is that an attacker can execute arbitrary code on the system running dalek-browser-chrome-canary, potentially leading to further compromise of the system.
No, there is currently no patch available for this vulnerability.
The best mitigation is to avoid using the dalek-browser-chrome-canary package and use an alternative package if possible. If the package is already installed, it is recommended to uninstall it.
The risk of exploitation can be reduced by ensuring that the package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
This vulnerability is classified as CWE-311.
