CVE-2016-10625: Insecure Download of Executable in headless-browser-lite
Summary
CVE-2016-10625: headless-browser-lite downloads Resources over HTTP. Affects headless-browser-lite versions < 2015.4.18-a. Fixed in 2015.4.18-a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
headless-browser-lite is an npm package that provides a lightweight headless browser for automated web scraping and testing. It allows users to interact with web pages, perform actions, and extract data programmatically. The package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in headless-browser-lite arises from the insecure download of an executable file. When the package attempts to download a resource, it does so over an unencrypted HTTP connection. This poses a security risk, as an attacker with a privileged network position can intercept the response and replace the executable with a malicious one. If the compromised executable is executed on the system running headless-browser-lite, it can lead to arbitrary code execution with the privileges of the user running the package.
How To Fix
Minimum fixed version
2015.4.18-a
This is the first release that contains the fix.
npm install headless-browser-lite@2015.4.18-aTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of headless-browser-lite.
Conclusion
The vulnerability in headless-browser-lite allows an attacker to replace a downloaded executable with a malicious one, leading to arbitrary code execution. To mitigate this risk, it is crucial to update headless-browser-lite to version 2015.4.18-a or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for headless-browser-lite →
FAQ
headless-browser-lite is an npm package that provides a lightweight headless browser for automated web scraping and testing. It allows users to interact with web pages, perform actions, and extract data programmatically.
The vulnerability allows an attacker with a privileged network position to intercept the download of an executable in headless-browser-lite and replace it with a malicious one. This can lead to arbitrary code execution on the system running the package.
To fix this vulnerability, update headless-browser-lite to version 2015.4.18-a or later.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of headless-browser-lite.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-g95j-p8f6-pwh4.
