CVE-2016-10665: Insecure Download of Executable in herbivore
Summary
CVE-2016-10665: herbivore downloads Resources over HTTP. Affects herbivore versions < 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
herbivore is an npm package that is used for downloading resources. It allows users to fetch files from the internet and store them locally. This package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This means that when downloading a file, if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running herbivore.
Vulnerability Detail
The vulnerability in herbivore arises from the insecure download of an executable over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, when the user runs the downloaded file, the malicious code will be executed on the system running herbivore. This can lead to various security issues, including unauthorized access, data theft, and system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, herbivore is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can allow an attacker to replace the downloaded executable with a malicious one, leading to code execution on the system. To fix this vulnerability, it is recommended to install the updated version of the herbivore package from GitHub. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for herbivore →
FAQ
The impact of this vulnerability is that an attacker can replace the downloaded executable with a malicious one, leading to code execution on the system running herbivore.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the package-lock.json file.
Yes, an updated version of the herbivore package is available on GitHub. You can install it using the command 'npm i samatt/herbivore'.
There are no known exploits for this vulnerability mentioned in the provided information.
The vulnerability details were discovered and reported by the GitHub Security Advisory Database.
