CVE-2017-16035: Insecure Resource Downloads in hubl-server
Summary
CVE-2017-16035: hubl-server downloads resources over HTTP. Affects hubl-server versions < 1.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hubl-server is an npm package that provides functionality for serving HubL templates. HubL is a templating language used in the HubSpot CMS. The package allows users to create and manage templates for their HubSpot websites. It is widely used by developers and website administrators to customize the appearance and functionality of their HubSpot sites. Unfortunately, hubl-server is vulnerable to insecure resource downloads, which can lead to code execution on the system running the server.
Vulnerability Detail
The vulnerability in hubl-server arises from the insecure download of dependencies over an unencrypted HTTP connection. This means that when hubl-server fetches its dependencies, it does not use HTTPS to ensure the integrity and authenticity of the downloaded files. An attacker with a privileged network position can intercept the responses and replace the legitimate dependencies with malicious ones. This can result in the execution of arbitrary code on the system running hubl-server. The vulnerability has a high severity rating and is classified under CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using hubl-server and choose an alternative package. If hubl-server is already installed on a private network, it is crucial to ensure that it is not connected to a public network to minimize the risk of exploitation.
Conclusion
The hubl-server package is vulnerable to insecure resource downloads, which can result in code execution on the system running the server. As no patch is available and the package has not been updated for several years, it is recommended to avoid using hubl-server and opt for a different package. If hubl-server is already installed on a private network, it is crucial to ensure that it is not connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubl-server →
FAQ
hubl-server is an npm package used for serving HubL templates in the HubSpot CMS. It allows users to create and manage templates for their HubSpot websites.
The vulnerability allows an attacker with a privileged network position to replace legitimate dependencies with malicious ones, potentially leading to code execution on the system running hubl-server.
No, there is currently no patch available for this vulnerability, and the package has not been updated since 2015.
The only workaround is to avoid using hubl-server and choose an alternative package. If hubl-server is already installed on a private network, it is important to ensure that it is not connected to a public network.
This vulnerability has a high severity rating.
