CVE-2016-10685: Insecure Download of Executable in pk-app-wonderbox
Summary
CVE-2016-10685: Downloads Resources over HTTP in pk-app-wonderbox. Affects pk-app-wonderbox versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pk-app-wonderbox is an npm package that allows users to download resources. It is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could result in code execution on the system running pk-app-wonderbox.
Vulnerability Detail
The vulnerability in pk-app-wonderbox arises from the insecure download of an executable over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. The consequences of this vulnerability include potential code execution on the system running pk-app-wonderbox. It is important to note that there is currently no patch available for this vulnerability. The best mitigation is to avoid using this package and consider using an alternative. If the package is installed on a private network, the risk of exploitation is limited to those who have compromised the network or have privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available for this vulnerability, the recommended workaround is to avoid using pk-app-wonderbox and consider using an alternative package. If you have already installed the package, it is recommended to uninstall it. Additionally, to reduce the risk of exploitation, ensure that the package is not installed while connected to a public network.
Conclusion
pk-app-wonderbox is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system running the package. Currently, there is no patch available for this vulnerability. The best course of action is to avoid using pk-app-wonderbox and consider using an alternative package. If you have already installed the package, uninstall it and take precautions to reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pk-app-wonderbox →
FAQ
pk-app-wonderbox is an npm package that allows users to download resources.
The vulnerability in pk-app-wonderbox is an insecure download of an executable over an unencrypted HTTP connection.
The possible consequences of this vulnerability include code execution on the system running pk-app-wonderbox.
No, there is currently no patch available for this vulnerability.
To mitigate the risk of exploitation, it is recommended to avoid using pk-app-wonderbox and consider using an alternative package. If the package is already installed, uninstall it. Additionally, ensure that the package is not installed while connected to a public network.
