Description

ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

Remediation

References

https://nodesecurity.io/advisories/182

https://www.npmjs.com/package/ibapi/v/2.5.6

https://gitlord.com/summary/~dchem%2Fnode-ibapi-addon.git

https://gitlord.com/commitdiff/~dchem%2Fnode-ibapi-addon.git/c00dd7c98cca0423052148337e523eeb7776da68

Related Vulnerabilities

CVE-2021-26541 Vulnerability in npm package gitlog

CVE-2023-20873 Vulnerability in maven package org.springframework.boot:spring-boot-actuator-autoconfigure

CVE-2019-10750 Vulnerability in npm package deeply

CVE-2015-5262 Vulnerability in maven package org.apache.httpcomponents:httpclient

CVE-2016-10656 Vulnerability in npm package qbs

Severity

Critical

Classification

CWE-310 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory