CVE-2016-10670: Insecure Download of Resources in windows-seleniumjar-mirror
Summary
CVE-2016-10670: Downloads Resources over HTTP in windows-seleniumjar-mirror. Affects windows-seleniumjar-mirror versions < 2.52.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The windows-seleniumjar-mirror package is an npm package used for downloading the Selenium jar file on Windows systems. It provides a convenient way to obtain the necessary Selenium jar file for running Selenium tests. The package is vulnerable to an insecure download of resources over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in windows-seleniumjar-mirror allows an attacker with a privileged network position to intercept the response and replace the downloaded executable with a malicious one. This can lead to code execution on the system running windows-seleniumjar-mirror. The impact of this vulnerability is significant as it can result in unauthorized code execution and potential compromise of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, follow these steps:
- Manually download the Selenium jar file from SeleniumHQ.
- Avoid installing the
windows-seleniumjar-mirrorpackage while connected to a public network. - If the package is installed on a private network, restrict access to trusted individuals and ensure network security measures are in place.
Conclusion
The windows-seleniumjar-mirror package is vulnerable to an insecure download of resources, which can lead to unauthorized code execution on the system. Currently, there is no patch available, and the best mitigation is to manually download the Selenium jar file from the official SeleniumHQ website. It is important to take network security measures and avoid installing the package while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for windows-seleniumjar-mirror →
FAQ
The impact of this vulnerability is significant as it allows an attacker to replace the downloaded executable with a malicious one, leading to unauthorized code execution on the system running windows-seleniumjar-mirror.
No, there is currently no patch available for this vulnerability. The best mitigation is to manually download the Selenium jar file from the official SeleniumHQ website.
This vulnerability requires an attacker to have a privileged network position to intercept the response and replace the downloaded executable. Therefore, remote exploitation is possible if the attacker can gain such a position.
The main alternative solution is to manually download the Selenium jar file from the official SeleniumHQ website instead of relying on the windows-seleniumjar-mirror package. Additionally, ensuring network security measures are in place can help reduce the risk of exploitation.
Those who have a privileged network position and can intercept the response to replace the downloaded executable can exploit this vulnerability. This includes attackers who have compromised the network or individuals with privileged access to the ISP.
