CVE-2016-10664: Insecure Download of Executable in mystem
Summary
CVE-2016-10664: mystem downloads Resources over HTTP. Affects mystem versions < 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mystem is an npm package that provides functionality for downloading resources. It is used to securely download files over HTTPS connections. However, certain versions of mystem have a vulnerability that allows the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could result in code execution on the system running mystem.
Vulnerability Detail
The vulnerability in mystem arises from the insecure download of an executable over an unencrypted HTTP connection. This can be exploited by an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. The impact of this vulnerability is that code execution can be achieved on the system running mystem. It is important to note that no patch is currently available for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk associated with this vulnerability, it is recommended to avoid using the mystem package and choose an alternative package that does not have this vulnerability. If it is necessary to use mystem, ensure that it is not installed while connected to a public network. This will reduce the likelihood of an attacker intercepting the response and replacing the executable with a malicious one.
Conclusion
The mystem package has a vulnerability that allows the insecure download of an executable over an unencrypted HTTP connection. This can be exploited by an attacker with a privileged network position to replace the executable with a malicious one, resulting in code execution on the system running mystem. Currently, there is no patch available for this vulnerability. It is recommended to avoid using the mystem package and choose an alternative package if possible. If mystem is installed on a private network, ensure that it is not accessible to unauthorized individuals. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mystem →
FAQ
The impact of this vulnerability is that an attacker with a privileged network position can intercept the response and replace the executable with a malicious one, resulting in code execution on the system running mystem.
No, there is currently no patch available for this vulnerability.
The best mitigation is to avoid using the mystem package and choose an alternative package if possible. If mystem is installed on a private network, ensure that it is not accessible to unauthorized individuals.
While the risk of exploitation is higher on a public network, it is still possible for an attacker with a privileged network position to exploit this vulnerability on a private network.
Those who can exploit this vulnerability are individuals who have compromised your network or those with privileged access to your ISP, such as nation-state actors or rogue ISP employees.
