CVE-2016-10611: Insecure Download of Executable in strider-sauce
Summary
CVE-2016-10611: Downloads Resources over HTTP in strider-sauce. Affects strider-sauce versions < 0.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
strider-sauce is an npm package used for downloading resources in the Strider Continuous Deployment platform. It provides functionality for securely downloading and managing executable files. However, certain versions of strider-sauce have a vulnerability that allows the insecure download of an executable over an unencrypted HTTP connection. This can be exploited by an attacker with privileged network access to intercept the response and replace the executable with a malicious one, leading to code execution on the system running strider-sauce.
Vulnerability Detail
The vulnerability in strider-sauce arises from the insecure download of an executable over HTTP. This means that if an attacker can intercept the network traffic, they can replace the downloaded executable with a malicious one. The impact of this vulnerability is high, as it can result in arbitrary code execution on the affected system. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2016-10611, and it has a CVSS score of 8.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in strider-sauce allows for the insecure download of an executable, which can be exploited by an attacker to execute arbitrary code on the affected system. To fix this vulnerability, manual installation of the patched version from GitHub is required. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for strider-sauce →
FAQ
The impact of this vulnerability is high, as it allows an attacker to execute arbitrary code on the system running strider-sauce.
Yes, this vulnerability can be exploited remotely if the attacker has a privileged network position to intercept the download.
Yes, a patch has been created by the package author. However, it has not been published to npm yet, so manual installation from GitHub is required.
No, only versions 0.0.1 to 0.6.2 of strider-sauce are affected by this vulnerability.
No, there is no known workaround for this vulnerability. Manual installation of the patched version is the only solution.
