CVE-2016-10634: Insecure Download of Executable in scalajs-standalone-bin
Summary
CVE-2016-10634: scalajs-standalone-bin Downloads Resources over HTTP. Affects scalajs-standalone-bin versions < 0.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
scalajs-standalone-bin is an npm package used for Scala.js development. It provides a standalone version of the Scala.js compiler that can be run in a web browser. This package allows developers to compile Scala code to JavaScript. However, versions of scalajs-standalone-bin prior to 0.4.3 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of scalajs-standalone-bin insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running scalajs-standalone-bin. The potential consequences include unauthorized access, data theft, and remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using scalajs-standalone-bin and choose a different package for Scala.js development. By using a package that does not have this vulnerability, the risk of exploitation can be mitigated.
Conclusion
The vulnerability in scalajs-standalone-bin allows an attacker to replace the downloaded executable with a malicious one, potentially leading to unauthorized access, data theft, and remote code execution. Currently, there is no patch available, so it is recommended to avoid using this package and opt for a different package if possible. Monitor the official repository for any updates or patches that may be released in the future. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for scalajs-standalone-bin →
FAQ
scalajs-standalone-bin is an npm package used for Scala.js development. It provides a standalone version of the Scala.js compiler that can be run in a web browser.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to unauthorized access, data theft, and remote code execution.
No, only versions prior to 0.4.3 are affected by this vulnerability.
No, there is currently no patch available. It is recommended to avoid using this package and monitor the official repository for any updates or patches.
To mitigate the risk, it is recommended to avoid using scalajs-standalone-bin and choose a different package for Scala.js development. If the package is already installed on a private network, ensure it is not used while connected to a public network.
