CVE-2016-10692: Insecure Download of Executable in haxeshim
Summary
CVE-2016-10692: Downloads Resources over HTTP in haxeshim. Affects haxeshim versions < 0.12.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
haxeshim is an npm package that provides a shim for the Haxe programming language. It is used to manage Haxe installations and dependencies. The package allows users to download and install Haxe executables from remote sources. However, it is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in haxeshim arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running haxeshim. The impact of this vulnerability is significant, as it allows an attacker to compromise the integrity and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the haxeshim package. Look for alternative packages that provide similar functionality and are not affected by this vulnerability.
Conclusion
The haxeshim package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system if an attacker intercepts and replaces the executable. No patch is currently available, so it is advised to avoid using the haxeshim package and look for alternative solutions. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for haxeshim →
FAQ
haxeshim is an npm package that provides a shim for the Haxe programming language. It is used for managing Haxe installations and dependencies.
The vulnerability allows an attacker to intercept and replace the executable downloaded by haxeshim, potentially leading to code execution on the system.
No, there is currently no patch available for this vulnerability.
To mitigate the risk, avoid using the haxeshim package and choose an alternative package if possible. If the package is installed on a private network, the risk is limited to those who have compromised the network or have privileged access to the ISP.
While it is not recommended, if you choose to use haxeshim, ensure that it is not installed while connected to a public network. This reduces the risk of interception and replacement of the downloaded executable.
