CVE-2016-10693: Insecure Download of Executable in pm2-kafka
Summary
CVE-2016-10693: Downloads Resources over HTTP in pm2-kafka. Affects pm2-kafka versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pm2-kafka is an npm package that provides functionality for managing Kafka processes using PM2. It allows users to easily deploy and manage Kafka applications. However, the package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of pm2-kafka insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running pm2-kafka.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using pm2-kafka and consider using an alternative package. If you must use pm2-kafka, ensure that it is not installed while connected to a public network. Install it only on a private network where the potential attackers are limited.
Conclusion
The pm2-kafka package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. Currently, there is no patch available, and the best mitigation is to avoid using the package. If you must use it, take precautions by installing it only on a private network and consider using alternative packages. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pm2-kafka →
FAQ
The impact of this vulnerability is that an attacker can replace the downloaded executable with a malicious one, leading to code execution on the system running pm2-kafka.
Yes, all versions of pm2-kafka are affected by this vulnerability.
No, currently there is no patch available for this vulnerability.
While it is not recommended, if you must use pm2-kafka, you can reduce the risk of exploitation by ensuring it is not installed while connected to a public network. Install it only on a private network where the potential attackers are limited.
Yes, there are alternative packages available for managing Kafka processes. Consider using one of those instead of pm2-kafka.
