CVE-2016-10588: Insecure Download of Executable in nw
Summary
CVE-2016-10588: Downloads Resources over HTTP in nw. Affects nw versions < 0.23.6-1. Fixed in 0.23.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nw package is an open-source framework that allows developers to build desktop applications using web technologies. It provides a platform for creating cross-platform applications by combining the Chromium rendering engine and Node.js. The package is commonly used for developing desktop applications with HTML, CSS, and JavaScript. However, versions of nw prior to 0.23.6-1 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in nw arises from the insecure download of an executable over an unencrypted HTTP connection. This means that when the package attempts to download a resource, such as an executable file, it does so without using encryption. This poses a security risk because an attacker with a privileged network position can intercept the response and replace the legitimate executable with a malicious one. If the user runs the compromised executable, it could lead to code execution on the system running nw. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0.23.6-1
This is the first release that contains the fix.
npm install nw@0.23.6-1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding downloading and executing executables from untrusted sources or over unencrypted connections.
Conclusion
The nw package prior to version 0.23.6-1 is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can allow an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system. To mitigate this vulnerability, it is crucial to update to version 0.23.6-1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nw →
FAQ
The impact of this vulnerability is that an attacker with a privileged network position can replace a downloaded executable with a malicious one, leading to code execution on the system running nw.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
No, only versions of nw prior to 0.23.6-1 are affected by this vulnerability. Updating to version 0.23.6-1 or later will fix the vulnerability.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
There is no specific information provided about known exploits for this vulnerability. However, it is always recommended to update to the latest secure version to mitigate the risk of any potential exploits.
