CVE-2016-10691: Insecure Download of Resources in windows-seleniumjar
Summary
CVE-2016-10691: windows-seleniumjar downloads Resources over HTTP. Affects windows-seleniumjar versions < 2.48.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The windows-seleniumjar package is an npm package used for Windows automation testing with Selenium. It provides a set of tools and libraries for interacting with web browsers programmatically. The package allows users to automate browser actions, such as clicking buttons, filling out forms, and navigating through web pages. However, the package is vulnerable to an insecure download of resources, which can lead to code execution on the system running windows-seleniumjar.
Vulnerability Detail
The vulnerability in windows-seleniumjar arises from insecurely downloading an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. As a result, when the package is used, the system running windows-seleniumjar may execute the malicious code. The impact of this vulnerability can be severe, as it allows an attacker to gain control over the affected system and potentially perform unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to uninstall the windows-seleniumjar package and use an alternative package for Windows automation testing with Selenium. This will help mitigate the risk of exploitation through the insecure download of resources.
Conclusion
The windows-seleniumjar package is vulnerable to an insecure download of resources, which can lead to code execution on the system running the package. Currently, there is no patch available, and the best mitigation is to avoid using the package and uninstall it if already installed. It is recommended to use an alternative package for Windows automation testing with Selenium. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for windows-seleniumjar →
FAQ
The impact of this vulnerability is severe, as it allows an attacker to execute arbitrary code on the system running windows-seleniumjar. This can lead to unauthorized access, data theft, and potentially further compromise of the affected system.
No, there is currently no patch available for this vulnerability. The best mitigation is to avoid using the windows-seleniumjar package and uninstall it if already installed.
This vulnerability can be exploited remotely if an attacker has a privileged network position and can intercept the download of resources over an unencrypted HTTP connection. However, the risk of exploitation can be reduced by ensuring the package is not installed while connected to a public network.
The recommended workaround is to uninstall the windows-seleniumjar package and use an alternative package for Windows automation testing with Selenium.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
