CVE-2016-10567

EUVD-2019-0296 · Published Feb 18, 2019

Downloads Resources over HTTP in product-monitor

Affected versions of product-monitor insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running product-monitor.

Recommendation

Update to versions 2.2.5 or later.

Technologies

Product-Monitor_Project Product-MonitorProduct-Monitor Product-Monitor

Weaknesses

CWE-311CWE-310

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Credential Access Discovery Collection

T1005Data from Local System T1040Network Sniffing T1056.004Credential API Hooking T1111Multi-Factor Authentication Interception T1539Steal Web Session Cookie T1552.004Private Keys

References

https://nodesecurity.io/advisories/171
https://nvd.nist.gov/vuln/detail/CVE-2016-10567
https://github.com/advisories/GHSA-h2r4-4xgf-3865
https://www.npmjs.com/advisories/171

Potentially impacted assets

See if this affects your attack surface