CVE-2016-10679: Insecure Download of Executable in selenium-standalone-painful
Summary
CVE-2016-10679: Downloads Resources over HTTP in selenium-standalone-painful. Affects selenium-standalone-painful versions 2.39.0-2.7.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
selenium-standalone-painful is an npm package that provides a painful way to install and run Selenium standalone server. It is commonly used for automating web browsers for testing purposes. This package allows users to download and execute the Selenium standalone server directly from the internet. However, affected versions of selenium-standalone-painful insecurely download the executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in selenium-standalone-painful arises from the insecure download of the executable. If an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running selenium-standalone-painful. The risk of exploitation is higher when connected to a public network, but even on a private network, attackers who have compromised the network or have privileged access to the ISP can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using selenium-standalone-painful. Consider using alternative packages that provide similar functionality but do not have this vulnerability.
Conclusion
The vulnerability in selenium-standalone-painful allows for the insecure download of an executable, which can be replaced by an attacker with a malicious one. To mitigate the risk, it is recommended to avoid using this package and choose an alternative. If you must use selenium-standalone-painful, ensure it is not installed while connected to a public network. Regularly check for updates or patches for this package and apply them as soon as they become available. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for selenium-standalone-painful →
FAQ
selenium-standalone-painful is an npm package used for installing and running Selenium standalone server for browser automation testing.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running selenium-standalone-painful.
To reduce the risk, avoid using selenium-standalone-painful and choose an alternative package. If you must use this package, ensure it is not installed while connected to a public network.
No, there is currently no patch available for this vulnerability.
For more information, you can refer to the GitHub Advisory Database entry for this vulnerability: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-3x83-p476-vv95/GHSA-3x83-p476-vv95.json
