CVE-2016-10591: Insecure Download of Executable in prince
Summary
CVE-2016-10591: Downloads Resources over HTTP in prince. Affects prince versions < 1.4.7. Fixed in 1.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prince is an npm package used for generating PDF documents from HTML and CSS. It provides a command-line interface for converting HTML files to PDF format. The package is widely used in various applications and projects for generating PDF documents dynamically. However, versions of prince prior to 1.4.7 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in prince arises from the insecure download of an executable over an unencrypted HTTP connection. This means that when the package attempts to download a resource, such as a file or script, it does so without using secure protocols like HTTPS. This can be exploited by an attacker who has a privileged network position to intercept the response and replace the executable with a malicious one. As a result, when the system running prince executes the downloaded executable, it can lead to arbitrary code execution with the privileges of the prince process.
How To Fix
Minimum fixed version
1.4.7
This is the first release that contains the fix.
npm install prince@1.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to a fixed version of the prince package.
Conclusion
In summary, versions of the prince package prior to 1.4.7 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can be exploited by attackers to replace the downloaded executable with a malicious one, leading to arbitrary code execution. To mitigate this vulnerability, it is crucial to update to version 1.4.7 or later of the prince package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for prince →
FAQ
Prince is an npm package used for generating PDF documents from HTML and CSS. It provides a command-line interface for converting HTML files to PDF format.
The vulnerability allows an attacker with a privileged network position to intercept and replace the executable downloaded by prince. This can lead to arbitrary code execution on the system running prince.
To fix this vulnerability, update to version 1.4.7 or later of the prince package.
There is no specific workaround mentioned for this vulnerability. Updating to a fixed version of the prince package is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-cr79-9pwf-r6f5/GHSA-cr79-9pwf-r6f5.json
