CVE-2016-10612: Insecure Download of Executable in dalek-browser-ie-canary
Summary
CVE-2016-10612: dalek-browser-ie-canary downloads Resources over HTTP. Affects dalek-browser-ie-canary versions < 0.0.4-2014-04-04-12-11-49. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
dalek-browser-ie-canary is an npm package that provides a browser automation library for Internet Explorer. It allows developers to automate tasks in Internet Explorer using JavaScript. However, versions of dalek-browser-ie-canary prior to 0.0.4-2014-04-04-12-11-49 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in dalek-browser-ie-canary occurs when it downloads an executable file over an unencrypted HTTP connection. This insecure download method can be exploited by an attacker who has a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running dalek-browser-ie-canary. This vulnerability poses a significant risk, especially in scenarios where the package is used on public networks or when an attacker has compromised the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using dalek-browser-ie-canary and find an alternative package that provides similar functionality but without this vulnerability.
Conclusion
In summary, dalek-browser-ie-canary versions prior to 0.0.4-2014-04-04-12-11-49 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection. No patch is available, and the package is marked as deprecated. It is recommended to avoid using this package and find alternative solutions. If you choose to use it, limit its usage to private networks to reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dalek-browser-ie-canary →
FAQ
dalek-browser-ie-canary is an npm package that allows developers to automate tasks in Internet Explorer using JavaScript.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running dalek-browser-ie-canary.
No, there is currently no patch available for this vulnerability.
It is strongly recommended to avoid using dalek-browser-ie-canary due to this vulnerability. Look for alternative packages that provide similar functionality.
If you must use dalek-browser-ie-canary, ensure that it is not installed while connected to a public network. Limit its usage to private networks to reduce the risk of exploitation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
