CVE-2016-10623: Insecure Download of Executable in macaca-chromedriver-zxa
Summary
CVE-2016-10623: Downloads Resources over HTTP in macaca-chromedriver-zxa. Affects macaca-chromedriver-zxa versions < 0.1.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
macaca-chromedriver-zxa is an npm package used for automating web browsers. It provides a driver for controlling Chrome browsers in automated tests. This package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of macaca-chromedriver-zxa insecurely download an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can result in code execution on the system running macaca-chromedriver-zxa. The vulnerability has a high severity rating and is classified as CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A workaround for this vulnerability is to manually set the download URL to a safe HTTPS server using the CHROMEDRIVER_CDNURL environment variable. Here is an example of how to set the variable:
export CHROMEDRIVER_CDNURL=https://safe-download-server.com
By setting the URL to a secure server, the download will be protected from interception and tampering.
Conclusion
macaca-chromedriver-zxa is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. To mitigate this vulnerability, it is recommended to manually set the download URL to a safe HTTPS server using the CHROMEDRIVER_CDNURL environment variable. Avoid installing this package while connected to a public network to reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for macaca-chromedriver-zxa →
FAQ
macaca-chromedriver-zxa is an npm package used for automating web browsers, specifically for controlling Chrome browsers in automated tests.
The vulnerability allows an attacker with a privileged network position to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running macaca-chromedriver-zxa.
To fix this vulnerability, you should manually set the download URL to a safe HTTPS server using the CHROMEDRIVER_CDNURL environment variable. This will ensure that the download is encrypted and secure.
Yes, you can still use macaca-chromedriver-zxa on a private network. However, it is important to ensure that the package is not installed while connected to a public network to reduce the risk of exploitation.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
