CVE-2016-10573

Vulnerability

The npm module baryton-saxophone versions before 3.0.1 downloads binary resources (such as Selenium Server binaries) over plain HTTP instead of HTTPS [1][2]. This lack of transport encryption makes the downloaded binary vulnerable to man-in-the-middle (MITM) attacks during the download process. The module is used to install and launch Selenium Server on Mac, Linux, and Windows systems [1].

Exploitation

An attacker must be positioned on the network between the user and the remote server (e.g., on a shared Wi-Fi, compromised router, or via ARP spoofing) [1]. No additional authentication or user interaction beyond the normal module install/update process is required. The attacker intercepts the HTTP request for the binary and replaces the legitimate binary with a malicious one, which is then executed by the system [2].

Impact

Successful exploitation allows the attacker to achieve remote code execution (RCE) on the victim's machine [1][2]. The attacker-controlled binary runs with the privileges of the user or process that launched baryton-saxophone, leading to full compromise of the application or system depending on the execution context [1].

Mitigation

The vulnerability is fixed in baryton-saxophone version 3.0.1 [2]. Users should upgrade to this version or later immediately. No workaround is available if the module remains on an affected version. The advisory was published to the GitHub Advisory Database on February 18, 2019 [2]. There is no known inclusion in CISA's KEV catalog.