CVE-2016-10604: Insecure Download of Executable in dalek-browser-chrome
Summary
CVE-2016-10604: dalek-browser-chrome Downloads Resources over HTTP. Affects dalek-browser-chrome versions < 0.0.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dalek-browser-chrome is an npm package that provides a browser automation library for Chrome. It allows users to automate browser tasks and perform tests. However, versions of dalek-browser-chrome prior to 0.0.11 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running dalek-browser-chrome.
Vulnerability Detail
The vulnerability in dalek-browser-chrome arises from the insecure download of an executable over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, the attacker can execute arbitrary code on the system running dalek-browser-chrome. This vulnerability poses a significant risk, especially in scenarios where the package is used on public networks or where an attacker has compromised the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in dalek-browser-chrome that allows for the insecure download of an executable over an unencrypted HTTP connection poses a significant risk. Currently, there is no patch available, and the best mitigation is to avoid using the package and consider alternative options like TestCafé. If you must use dalek-browser-chrome, take precautions by not installing it while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dalek-browser-chrome →
FAQ
The impact of this vulnerability is that an attacker can replace the executable downloaded by dalek-browser-chrome with a malicious one, leading to code execution on the system running the package.
Currently, there is no patch available for this vulnerability.
The author of dalek recommends using TestCafé as an alternative package.
To reduce the risk of exploitation, avoid installing dalek-browser-chrome while connected to a public network. Limiting access to the package can help mitigate the vulnerability.
Those who have a privileged network position, such as an attacker who has compromised the network or has privileged access to the ISP, can exploit this vulnerability.
