CVE-2016-10663: Insecure Download of Resources in wixtoolset
Summary
CVE-2016-10663: wixtoolset downloads Resources over HTTP. Affects wixtoolset versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wixtoolset is an npm package that provides a set of tools for building Windows Installer packages. It is commonly used for creating installation packages for Windows applications. The package allows developers to define the structure and behavior of the installer and includes various components and utilities for this purpose. However, wixtoolset is vulnerable to an insecure download of resources, which can lead to code execution on the system running the package.
Vulnerability Detail
The vulnerability in wixtoolset arises from the insecure download of an executable over an unencrypted HTTP connection. This means that when the package attempts to download a resource, an attacker with a privileged network position can intercept the response and replace the executable with a malicious one. As a result, when the package is executed, the system may run the malicious code instead. This can lead to arbitrary code execution and potential compromise of the system. The package has not received any updates since 2015, and no patch is currently available.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The wixtoolset package is vulnerable to an insecure download of resources, which can result in arbitrary code execution on the system. As there is no patch available, it is recommended to avoid using this package and consider alternative options. If the package is already installed on a private network, precautions should be taken to limit the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wixtoolset →
FAQ
wixtoolset is an npm package used for building Windows Installer packages.
The vulnerability allows an attacker to replace downloaded resources with malicious executables, potentially leading to arbitrary code execution on the system running wixtoolset.
No, there is currently no patch available for this vulnerability.
Yes, developers can consider using alternative packages that provide similar functionality but do not have this vulnerability.
The risk of exploitation can be reduced by avoiding the use of wixtoolset while connected to a public network, limiting potential attackers to those who have compromised the private network or have privileged access to the ISP.
