CVE-2016-10669: Insecure Download of Executable in soci
Summary
CVE-2016-10669: Downloads Resources over HTTP in soci. Affects soci versions < 3.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The soci package is an npm package that provides a C++ database access library. It allows developers to interact with various database systems using a unified API. The package is widely used in Node.js applications for database operations. However, versions of soci prior to 3.2.2 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in soci arises from the insecure download of an executable file over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running soci. The risk of exploitation is higher when connected to a public network, but even on a private network, it requires an attacker who has compromised the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the soci package and use an alternative package that does not have this vulnerability.
Conclusion
The soci package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. Currently, there is no patch available, and the best mitigation is to avoid using the package. If already installed, it is recommended to uninstall it and use an alternative package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for soci →
FAQ
The impact of this vulnerability is that an attacker can replace the downloaded executable with a malicious one, leading to code execution on the system running soci.
No, this vulnerability requires an attacker to have a privileged network position or compromised network access.
No, there is currently no patch available for this vulnerability.
The best mitigation is to avoid using the soci package and use an alternative package. If already installed on a private network, ensure it is not installed while connected to a public network.
If you have already installed soci, it is recommended to uninstall it and use an alternative package.
