CVE-2016-10687: Insecure Download of Executable in windows-selenium-chromedriver
Summary
CVE-2016-10687: windows-selenium-chromedriver downloads Resources over HTTP. Affects windows-selenium-chromedriver versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The windows-selenium-chromedriver package is an npm package that provides a Windows-compatible version of the Selenium ChromeDriver. It is commonly used in automated testing scenarios where Selenium is used to control web browsers. The package allows developers to automate interactions with the Chrome browser. However, the package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in windows-selenium-chromedriver arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running windows-selenium-chromedriver. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the windows-selenium-chromedriver package and consider using an alternative package that does not have this vulnerability. Additionally, if the package is already installed, it is advisable to uninstall it while connected to a public network and only use it on a private network with restricted access.
Conclusion
The windows-selenium-chromedriver package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the affected system. Currently, there is no patch available, so the best course of action is to avoid using this package and consider using an alternative. Uninstalling the package while connected to a public network and only using it on a private network can also reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for windows-selenium-chromedriver →
FAQ
The impact of this vulnerability is severe, as it allows an attacker to execute arbitrary code on the affected system.
No, currently there is no patch available for this vulnerability.
The best mitigation is to avoid using the windows-selenium-chromedriver package and consider using an alternative package if available. Additionally, ensure that the package is not installed while connected to a public network.
If you have already installed the windows-selenium-chromedriver package, it is advisable to uninstall it while connected to a public network and only use it on a private network with restricted access.
There are no known exploits of this vulnerability at the moment, but the risk of exploitation exists for those who have a privileged network position.
