PT-2018-4766 · Nw.Js · Nw

Published 2018-06-01 · Updated 2019-10-09 · CVE-2016-10588

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nw versions prior to 0.23.6-1

Description The issue allows for potential remote code execution (RCE) by swapping out the requested zip file with an attacker-controlled binary if the attacker is on the network or positioned in between the user and the remote server. This is possible because nw downloads zipped resources over HTTP. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running nw.

Recommendations Update to version 0.23.6-1 or later.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-310

CWE-311

Related Identifiers

CVE-2016-10588

GHSA-HV96-XXX2-5V7W

Affected Products

Nw

References · 7

• https://osv.dev/vulnerability/GHSA-hv96-xxx2-5v7w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10588 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10588 · Vendor Advisory
• https://github.com/nwjs/npm-installer/commit/adb4df1e012d38a3872578d484291b9af07aad5b · Note
• https://nodesecurity.io/advisories/166 · Note
• https://npmjs.com/advisories/166 · Note
• https://github.com/advisories/GHSA-hv96-xxx2-5v7w · Note