CVE-2016-10651: Insecure Download of Resources in webdriver-launcher
Summary
CVE-2016-10651: Downloads Resources over HTTP in webdriver-launcher. Affects webdriver-launcher versions < 0.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The webdriver-launcher package is an npm package used for launching webdrivers in Node.js applications. It provides a convenient way to automate web browsers for testing or scraping purposes. The package allows users to download and execute webdrivers for various browsers. However, it is vulnerable to an insecure download of resources over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in webdriver-launcher arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running webdriver-launcher. The package has not received any updates since 2011, and no patch is currently available.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The webdriver-launcher package is vulnerable to an insecure download of resources over an unencrypted HTTP connection. As no patch is available and the package has not been updated since 2011, it is recommended to avoid using this package and choose an alternative. If the package is already installed, it is advised to uninstall it. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for webdriver-launcher →
FAQ
The impact of this vulnerability is that an attacker with a privileged network position can replace the downloaded executable with a malicious one, potentially leading to code execution on the system running webdriver-launcher.
No, there is currently no patch available for this vulnerability, and the package has not seen any updates since 2011.
The best mitigation is to avoid using the webdriver-launcher package and choose an alternative package if possible. Additionally, ensure that the package is not installed while connected to a public network to reduce the risk of exploitation.
In order to exploit this vulnerability, an attacker needs to have a privileged network position or compromised access to the network or ISP. This means that only individuals with such access can exploit the vulnerability.
There are no known instances of this vulnerability being exploited.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
