CVE-2016-10676: Insecure Download of Executable in rs-brightcove
Summary
CVE-2016-10676: Downloads Resources over HTTP in rs-brightcove. Affects rs-brightcove versions < 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rs-brightcove package is an npm package used for downloading resources from the Brightcove video platform. It provides functionality for interacting with the Brightcove API and managing video content. However, this package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in rs-brightcove arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running rs-brightcove. The risk of exploitation is higher when connected to a public network, but even on a private network, attackers with compromised network access or privileged ISP access can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Currently, there is no patch available for this vulnerability. The best mitigation is to avoid using the rs-brightcove package and opt for an alternative package if possible. If the package is already installed on a private network, it is recommended to ensure that it is not connected to a public network. This reduces the risk of exploitation by limiting access to the package.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using the rs-brightcove package and choose a different package for downloading resources from the Brightcove video platform.
Conclusion
The rs-brightcove package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. To mitigate the risk, it is recommended to avoid using this package and choose an alternative. There is currently no patch available for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rs-brightcove →
FAQ
The impact of this vulnerability is that an attacker can replace the downloaded executable with a malicious one, leading to code execution on the system running rs-brightcove.
This vulnerability can be exploited remotely if the attacker has a privileged network position or privileged ISP access.
No, there is currently no patch available for this vulnerability.
To reduce the risk of exploitation, it is recommended to avoid using the rs-brightcove package and choose an alternative package. Additionally, ensure that the package is not installed while connected to a public network.
This vulnerability can be exploited by attackers with a privileged network position or privileged ISP access, such as Nation State Actors or Rogue ISP Employees.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.