CVE-2016-10571

Vulnerability

bkjs-wand, an ImageMagick wand support package for Node.js and backendjs, downloads binary resources over HTTP in versions prior to 0.3.2 [1][2]. This insecure transport exposes the download to man-in-the-middle (MITM) attacks, as no encryption or integrity verification is used for the binary retrieval.

Exploitation

An attacker with network access—either on the same local network or positioned between the user and the remote server—can intercept the HTTP request for the binary resource and replace it with a malicious binary [1][2]. No authentication or user interaction beyond the normal package installation or update process is required; the attack occurs transparently during the download.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system with the privileges of the user running the Node.js application that uses bkjs-wand [1][2]. This results in full remote code execution (RCE), potentially leading to data theft, system compromise, or further lateral movement.

Mitigation

Upgrade bkjs-wand to version 0.3.2 or later, which addresses the issue by using HTTPS for binary downloads [2]. No workarounds are documented for earlier versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.