CVE-2016-10613: Insecure Resource Downloads in bionode-sra
Summary
CVE-2016-10613: Downloads Resources over HTTP in bionode-sra. Affects bionode-sra versions < 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bionode-sra is an npm package that allows users to download and process Sequence Read Archive (SRA) data. It provides a convenient interface for accessing biological sequence data stored in the SRA database. However, the package is vulnerable to insecure resource downloads over HTTP, which can be exploited by attackers with privileged network positions. The severity of the impact depends on the behavior of the package and can range from information disclosure to remote code execution.
Vulnerability Detail
The vulnerability in bionode-sra arises from its insecure downloading of resources over HTTP. When an attacker has a privileged network position, they can modify or read these resources at will. The exact impact of this vulnerability varies but can be severe, potentially leading to the compromise of sensitive information or even remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To work around this vulnerability, you can use the alternative package urllib-sync instead of bionode-sra. This package provides a similar functionality but does not suffer from the insecure resource download issue. You can install urllib-sync using the following command:
npm install urllib-sync
Conclusion
In summary, bionode-sra is vulnerable to insecure resource downloads over HTTP, which can have varying degrees of impact depending on the package's behavior. Currently, there is no patch available, and the best course of action is to avoid using bionode-sra and consider alternative packages like urllib-sync. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bionode-sra →
FAQ
bionode-sra is an npm package that allows users to download and process Sequence Read Archive (SRA) data. It provides a convenient interface for accessing biological sequence data stored in the SRA database.
The impact of this vulnerability can vary depending on the behavior of the package. It can range from information disclosure to remote code execution, potentially leading to the compromise of sensitive data.
No, there is currently no patch available for this vulnerability. The best mitigation is to avoid using bionode-sra and consider alternative packages.
The author of bionode-sra suggests using urllib-sync as an alternative. This package provides similar functionality but does not suffer from the insecure resource download issue.
To reduce the risk of exploitation, ensure that bionode-sra is not installed while connected to a public network. If the package is installed on a private network, only individuals who have compromised the network or have privileged access to the ISP can exploit the vulnerability.
