Supply chain attack via MiTM against users

Vulnerability

Ballerina versions 1.2.x and SwanLake releases up to alpha3 (inclusive) are affected by a supply chain vulnerability in the package retrieval mechanism. The ballerina pull, build, and run commands used unencrypted HTTP connections to fetch modules from Ballerina Central (BC) and did not validate TLS certificates [1][2]. This allowed an attacker positioned on the network to intercept and modify packages during transit.

Exploitation

An attacker with man-in-the-middle (MiTM) capability on the network between the Ballerina client and Ballerina Central can intercept HTTP requests for package downloads. Because the connection lacked TLS and certificate checking was disabled, the attacker can substitute the legitimate package with a malicious one without detection. No authentication or user interaction beyond a standard package operation is required.

Impact

Successful exploitation allows the attacker to inject arbitrary malicious code into the Ballerina executable. This constitutes a supply chain attack, compromising the integrity of the software built with the affected Ballerina versions. The attacker gains the ability to execute code in the context of the user running the Ballerina commands, potentially leading to full system compromise.

Mitigation

The vulnerability has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4 [2]. Users should upgrade to these or later versions immediately. The fix enforces HTTPS connections and proper TLS certificate validation for all package downloads from Ballerina Central [1]. No workaround is available for unpatched versions; upgrading is the only mitigation.