CVE-2016-10667: Insecure Download of Executable in selenium-portal
Summary
CVE-2016-10667: Downloads Resources over HTTP in selenium-portal. Affects selenium-portal versions < 0.0.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
selenium-portal is an npm package that provides functionality for automating web browsers. It allows users to control browsers programmatically, perform actions on web pages, and retrieve data. The package has not been updated since 2014 and is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of selenium-portal insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one, potentially leading to code execution on the system running selenium-portal.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the selenium-portal package. Instead, consider using a different package that provides similar functionality and is actively maintained and updated.
Conclusion
The selenium-portal package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. As no patch is available and the package has not been updated since 2014, it is recommended to avoid using this package and consider using an alternative. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for selenium-portal →
FAQ
selenium-portal is an npm package that allows users to automate web browsers and perform actions on web pages programmatically.
The vulnerability allows an attacker with a privileged network position to intercept and replace the executable downloaded by selenium-portal, potentially leading to code execution on the system running the package.
No, there is currently no patch available for this vulnerability, and the package has not been updated since 2014.
To mitigate the risk, it is recommended to avoid using the selenium-portal package and use an alternative package if possible. Additionally, ensure that the package is not installed while connected to a public network.
The vulnerability can be exploited by attackers who have a privileged network position, such as those who have compromised your network or those with privileged access to your ISP.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
