CVE-2016-10629: Insecure Download of Executable in nw-with-arm
Summary
CVE-2016-10629: nw-with-arm downloads Resources over HTTP. Affects nw-with-arm versions < 0.14.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nw-with-arm package is an npm package that is used for running Node.js applications with the NW.js framework on ARM architectures. It allows developers to build and deploy desktop applications using web technologies. The package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in nw-with-arm arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running nw-with-arm. The vulnerability has a high severity rating and is classified under CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using the nw-with-arm package and choose an alternative package that does not have this vulnerability. Additionally, it is important to ensure that the package is not installed while connected to a public network.
Conclusion
The nw-with-arm package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. Currently, there is no patch available for this vulnerability. It is recommended to avoid using this package and opt for an alternative if possible. If the package is already installed on a private network, ensure that it is not connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nw-with-arm →
FAQ
The impact of this vulnerability is that an attacker with a privileged network position can replace the executable downloaded by nw-with-arm with a malicious one, leading to code execution on the system.
No, there is currently no patch available for this vulnerability.
This vulnerability has a high severity rating.
This vulnerability can be exploited remotely if the attacker has a privileged network position.
The best mitigation is to avoid using the nw-with-arm package and choose an alternative package if available. Additionally, ensure that the package is not installed while connected to a public network.
