CVE-2016-10587: Insecure Download of Executable in wasdk
Summary
CVE-2016-10587: Downloads Resources over HTTP in wasdk. Affects wasdk versions < 1.0.54. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wasdk package is an npm package used for a specific purpose. It is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This means that when downloading resources, the package does not use a secure HTTPS connection, making it susceptible to interception and replacement of the executable with a malicious one. This vulnerability can lead to code execution on the system running wasdk if an attacker has a privileged network position.
Vulnerability Detail
The vulnerability in wasdk arises from the insecure download of an executable over an unencrypted HTTP connection. When an attacker with a privileged network position intercepts the response, they can replace the executable with a malicious one. This can result in code execution on the system running wasdk. The risk of exploitation is higher when connected to a public network, but even on a private network, it can be exploited by those who have compromised the network or have privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, there is no specific workaround provided for this vulnerability.
Conclusion
The wasdk package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system running wasdk if an attacker intercepts and replaces the executable. Currently, there is no fix available for this vulnerability. The best mitigation is to avoid using this package and consider alternatives. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wasdk →
FAQ
The impact of this vulnerability is that an attacker can replace the executable downloaded by wasdk with a malicious one, leading to code execution on the system running wasdk.
Currently, there is no fix available for this vulnerability in wasdk. The best course of action is to avoid using this package and consider alternatives.
To reduce the risk of exploitation, avoid installing the wasdk package while connected to a public network. However, it's important to note that this does not eliminate the vulnerability entirely.
There may be known exploits of this vulnerability, especially by attackers with a privileged network position. However, specific details about known exploits are not provided in this report.
No specific timeline for a fix is mentioned in the vulnerability details. It is recommended to monitor the official repository or sources for any updates on a fix.
