CVE-2016-10648: Insecure Download of Executable in marionette-socket-host
Summary
CVE-2016-10648: marionette-socket-host downloads Resources over HTTP. Affects marionette-socket-host versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
marionette-socket-host is an npm package that is used for socket-based communication with the Marionette protocol. It allows remote control of the Firefox browser and is commonly used for automated testing and debugging. The package provides a socket server that listens for incoming connections and handles communication with the Marionette protocol. However, versions of marionette-socket-host prior to 0.1.2 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in marionette-socket-host arises from the insecure download of an executable over an unencrypted HTTP connection. This means that when the package is installed or updated, it fetches an executable file from a remote server using an insecure connection. If an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. When the package runs, the compromised executable would be executed, leading to arbitrary code execution on the system running marionette-socket-host. This vulnerability poses a significant risk, especially in scenarios where the package is installed on a public network or where an attacker has compromised the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available for this vulnerability, the recommended workaround is to uninstall the marionette-socket-host package if it is already installed. To uninstall the package, use the following command:
npm uninstall marionette-socket-host
Conclusion
The marionette-socket-host package is vulnerable to an insecure download of an executable, which can lead to arbitrary code execution on the system. Currently, no patch is available, and the package has been removed from the author's GitHub account. It is recommended to uninstall the package and consider alternative solutions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for marionette-socket-host →
FAQ
marionette-socket-host is an npm package used for socket-based communication with the Marionette protocol, allowing remote control of the Firefox browser for automated testing and debugging.
The vulnerability allows an attacker with a privileged network position to replace the downloaded executable with a malicious one, leading to arbitrary code execution on the system running marionette-socket-host.
No, currently there is no patch available for this vulnerability, and the package has been removed from the author's GitHub account.
To mitigate the risk, it is recommended to avoid using the marionette-socket-host package and look for alternative packages. If already installed, uninstall the package. Additionally, ensure that the package is not installed while connected to a public network.
The vulnerability can be exploited by attackers who have a privileged network position, have compromised the network, or have privileged access to the ISP, such as nation-state actors or rogue ISP employees.
