CVE-2016-10613

Vulnerability

bionode-sra, a Node.js wrapper for the SRA Toolkit, downloads data resources over plain HTTP without TLS. This design choice leaves all data in transit vulnerable to man-in-the-middle attacks. The affected package is any version of bionode-sra that relies on HTTP for data retrieval, as described in the official advisory [1]. The official GitHub repository [2] confirms the package's functionality as a wrapper for the SRA Toolkit, but does not provide specific version information or indicate that HTTPS is used.

Exploitation

An attacker with network access between the user and the remote server hosting SRA data can intercept the HTTP traffic. No authentication or user interaction beyond running the tool is required; any user of bionode-sra that triggers a data download is susceptible. The attacker can perform a standard man-in-the-middle attack by intercepting the HTTP request and response, potentially modifying or replacing the downloaded files without the user's knowledge.

Impact

Successful exploitation allows the attacker to replace the intended data with arbitrary content, leading to a complete loss of integrity and possible confidentiality or availability compromise. Since the data may be used in downstream scientific analysis, the impact could include corrupted research results or execution of malicious payloads if the downloaded content is processed unsafely (e.g., via shell commands). The attacker does not gain direct system access but can inject malicious data into the user's workflow.

Mitigation

No official fix has been released for bionode-sra as of the publication date of this CVE. The package appears to be deprecated or unmaintained, and no updated version addressing the HTTP vulnerability is mentioned in the available references [1][2]. Users should avoid using bionode-sra altogether or manually ensure that all downloaded data is transferred over HTTPS by using alternative tools or proxying through a secure connection. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.