CVE-2016-10677: Insecure Download of Executable in google-closure-tools-latest
Summary
CVE-2016-10677: Downloads Resources over HTTP in google-closure-tools-latest. Affects google-closure-tools-latest versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
google-closure-tools-latest is an npm package that provides a set of tools for optimizing and compiling JavaScript code. It is commonly used for building large-scale JavaScript applications. This package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of google-closure-tools-latest insecurely download an executable over an unencrypted HTTP connection. This vulnerability allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, code execution on the system running google-closure-tools-latest can be achieved. This vulnerability is particularly dangerous in scenarios where the package is installed on a public network or when an attacker has compromised the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To reduce the risk of exploitation, it is recommended to avoid installing the google-closure-tools-latest package while connected to a public network. If the package is installed on a private network, the potential attackers are limited to those who have compromised the network or have privileged access to the ISP.
Conclusion
The google-closure-tools-latest package is vulnerable to an insecure download of an executable, which can lead to code execution on the system. It is recommended to avoid using this package and instead manually install the closure compiler from the official GitHub repository. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for google-closure-tools-latest →
FAQ
google-closure-tools-latest is an npm package that provides tools for optimizing and compiling JavaScript code.
This vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running google-closure-tools-latest.
No, there is currently no patch available for this vulnerability.
The best mitigation is to avoid using the google-closure-tools-latest package and manually install the closure compiler from the official GitHub repository. Additionally, avoid installing the package while connected to a public network.
Those who have a privileged network position, such as attackers who have compromised the network or have privileged access to the ISP, can exploit this vulnerability.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
