CVE-2016-10684: Insecure Download of Executable in healthcenter
Summary
CVE-2016-10684: Downloads Resources over HTTP in healthcenter. Affects healthcenter versions < 3.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The healthcenter package is an npm package that has been deprecated and replaced by the appmetrics package. It is used for monitoring and analyzing the performance of Node.js applications. However, versions of healthcenter prior to 3.0.3 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in healthcenter arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running healthcenter. The impact of this vulnerability can be severe, as it allows an attacker to compromise the integrity and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The healthcenter package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. To mitigate this vulnerability, it is recommended to uninstall healthcenter and install the appmetrics package instead. It is important to keep your packages up to date and follow best practices for secure package management. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for healthcenter →
FAQ
The impact of this vulnerability is that an attacker can replace the executable downloaded by healthcenter with a malicious one, leading to code execution on the system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and alerts you in real-time for open-source vulnerabilities.
There is no specific workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability.
No, only versions of healthcenter prior to 3.0.3 are affected by this vulnerability. It is recommended to update to the latest version of appmetrics to ensure the vulnerability is fixed.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
