CVE-2016-10628: Insecure Download of Resources in selenium-wrapper
Summary
CVE-2016-10628: selenium-wrapper downloads Resources over HTTP. Affects selenium-wrapper versions < 0.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
selenium-wrapper is an npm package that provides a wrapper around the Selenium WebDriver for automating web browsers. It allows developers to write automated tests for web applications. The package is widely used in the JavaScript ecosystem for browser automation tasks. However, versions of selenium-wrapper prior to 0.0.10 are vulnerable to an insecure download of resources.
Vulnerability Detail
The vulnerability in selenium-wrapper arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running selenium-wrapper. The risk of exploitation is higher when connected to a public network, but even on a private network, it is still possible for attackers who have compromised the network or have privileged access to the ISP to exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using the selenium-wrapper package. If you need browser automation capabilities, consider using a different package that does not have this vulnerability.
Conclusion
The selenium-wrapper package has a vulnerability that allows for the insecure download of resources. This can lead to code execution on the system running selenium-wrapper if an attacker intercepts the download and replaces the executable with a malicious one. The best mitigation is to avoid using the package and opt for an alternative. Regularly checking for updates and patches for the package is also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for selenium-wrapper →
FAQ
selenium-wrapper is an npm package that provides a wrapper around the Selenium WebDriver for automating web browsers. It is commonly used for writing automated tests for web applications.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running selenium-wrapper.
No, there is currently no patch available for this vulnerability.
The risk of exploitation can be reduced by avoiding the use of selenium-wrapper and opting for an alternative package. If you must use selenium-wrapper, ensure that it is not installed while connected to a public network.
In scenarios where an attacker has a privileged network position, they can exploit this vulnerability. This includes attackers who have compromised the network or have privileged access to the ISP.
