CVE-2016-10696: Insecure Download of Executable in windows-latestchromedriver
Summary
CVE-2016-10696: Downloads Resources over HTTP in windows-latestchromedriver. Affects windows-latestchromedriver versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The windows-latestchromedriver package is an npm package that provides a driver for automating the Chrome browser on Windows systems. It allows developers to interact with the Chrome browser programmatically. This package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in windows-latestchromedriver arises from the insecure download of an executable over an unencrypted HTTP connection. This means that when the package is installed, it retrieves an executable file from a remote server using an insecure connection. An attacker with a privileged network position can intercept the response and replace the executable with a malicious one. If successful, this could lead to code execution on the system running windows-latestchromedriver. The vulnerability has a high severity rating (CWE-311) and poses a significant risk if the package is installed while connected to a public network.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk of exploitation, it is recommended to uninstall the windows-latestchromedriver package if it is already installed. Additionally, ensure that the package is not installed while connected to a public network. If the package is necessary for your application, consider implementing additional security measures such as using a secure network connection or verifying the integrity of the downloaded executable.
Conclusion
The windows-latestchromedriver package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system if the downloaded executable is replaced with a malicious one. Currently, there is no patch available for this vulnerability, and the best mitigation is to avoid using the package and use an alternative if possible. If the package is already installed, it is recommended to uninstall it and ensure it is not installed while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for windows-latestchromedriver →
FAQ
The impact of this vulnerability is that an attacker with a privileged network position can replace the downloaded executable with a malicious one, potentially leading to code execution on the system running windows-latestchromedriver.
No, there is currently no patch available for this vulnerability.
This vulnerability can be exploited remotely if the attacker has a privileged network position and can intercept the download of the executable.
To protect your system, it is recommended to avoid using the windows-latestchromedriver package and use an alternative if possible. If the package is already installed, uninstall it and ensure it is not installed while connected to a public network.
This vulnerability can be exploited by individuals who have compromised your network or have privileged access to your ISP, such as nation-state actors or rogue ISP employees.
