CVE-2016-10624: Insecure Download of Resources in selenium-chromedriver
Summary
CVE-2016-10624: selenium-chromedriver Downloads Resources over HTTP. Affects selenium-chromedriver versions < 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
selenium-chromedriver is an npm package that provides a WebDriver implementation for Chrome. It allows developers to automate the testing of web applications in the Chrome browser. The package is widely used in the development and testing of web applications.
Vulnerability Detail
The affected versions of selenium-chromedriver insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker who has a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running selenium-chromedriver.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The selenium-chromedriver package has a vulnerability that allows for the insecure download of resources. It is recommended to avoid using this package and choose an alternative. There is currently no patch available, and the package has been marked as deprecated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for selenium-chromedriver →
FAQ
selenium-chromedriver is an npm package that provides a WebDriver implementation for Chrome. It is used for automating the testing of web applications in the Chrome browser.
The vulnerability allows an attacker with a privileged network position to replace the downloaded executable with a malicious one, leading to code execution on the system running selenium-chromedriver.
No, there is currently no patch available for this vulnerability.
The best mitigation is to avoid using this package and choose an alternative if possible. Additionally, ensure that the package is not installed while connected to a public network.
If the package is installed on a private network, only individuals who have compromised your network can exploit this vulnerability.
